What to do if you've been hacked
Discovering (or suspecting) that your business has been hacked is stressful. The instinct is either to panic or to hope it goes away. Neither helps. What matters is acting quickly and methodically. Here's what to do, in order, if you think something's gone wrong.
Last updated
The short answer
Stop, contain, and get help. Don't wipe anything, don't turn off machines (unless told to), and don't try to fix it yourself if you're not sure what happened. Disconnect affected devices from the network, change your passwords from a different device, and call your IT support. If personal data may have been exposed, you may have legal obligations to report it. The faster you respond, the less damage is done.
What to consider
Signs you've been compromised
Unexpected password reset emails, logins from strange locations, missing files, ransomware messages, or colleagues receiving odd emails from your account are all red flags.
Don't wipe or restart yet
Your first instinct might be to reset everything, but that can destroy evidence needed to understand what happened and prevent it happening again.
Disconnect, don't power off
Unplug the network cable or turn off Wi-Fi on affected devices to stop the spread, but leave them powered on so forensic data is preserved.
Change passwords from a clean device
Use your phone or another computer that wasn't affected to change passwords on email, banking, and any critical systems. Start with the most important ones.
Check your legal obligations
Under Australia's Notifiable Data Breaches scheme, if personal data has been exposed, you may be required to notify the OAIC and affected individuals within 30 days.
Record what happened
Write down what you noticed, when, and what you've done so far. That timeline helps your IT support and any authorities involved.
Who this guide is for
- Business owners who think their systems or accounts have been compromised right now.
- Staff who've noticed something suspicious and aren't sure what to do next.
- Businesses that want an incident response plan before something goes wrong.
- Anyone who's received a ransomware demand or discovered unauthorised access.
What to do next
- Isolate affected devices. Disconnect them from the network immediately (Wi-Fi off, ethernet unplugged), but leave them switched on.
- Change critical passwords. From a clean device, change your email, banking, and admin passwords. Enable MFA if it isn't already on.
- Call your IT support. If you have managed IT, call them now. If you don't, call someone who handles incident response. This isn't the time for DIY.
- Report it. Report to the ACSC via cyber.gov.au (or call 1300 292 371). If personal data is involved, assess whether you need to notify the OAIC.
- Review and harden. Once contained, work with your IT support to close the gap that was exploited and put measures in place to prevent a repeat.
How WaTo can help
- We respond to cyber incidents quickly, contain the damage and work out what happened.
- We help you meet your reporting obligations under the Notifiable Data Breaches scheme.
- We restore from clean backups and verify your systems are safe before bringing them back online.
- We identify how the breach occurred and close the gap so it doesn't happen again.
- After the incident, we help you put proper security in place: monitoring, MFA, patching, and a response plan.
Related questions
Should I pay a ransomware demand?
The Australian government recommends against paying ransoms. There's no guarantee you'll get your data back, and it funds further criminal activity. If you have proper backups, you can recover without paying. Call your IT support and the ACSC before making any decisions.
How do I know if customer data was accessed?
Your IT support can review logs to determine what was accessed. If there's any possibility that personal information was exposed, treat it as a potential notifiable breach and start the assessment process.
Can I just restore from backup and move on?
Restoring from backup is part of recovery, but you also need to understand how the attacker got in and close that gap first. Otherwise you're just resetting the clock until the next incident.
Who do I need to notify in Australia?
If personal information has been compromised and there's a risk of serious harm, you must notify the OAIC and affected individuals under the Notifiable Data Breaches scheme. The ACSC (1300 292 371) can also assist with the technical response.
How WaTo can help with this
Need help right now?
If you think your business has been compromised, call us. We handle cyber incidents for Adelaide businesses and can help you contain the damage, recover your systems, and get back on your feet.
Mon to Fri, 8:30am to 5pm
