Ransomware readiness for small business
How ransomware gets into Australian small and medium businesses, the ten things that stop most of it, how to keep backups an attacker cannot reach, and what to do in the first hour if you are hit. In plain language, for whoever looks after IT, even if that is you.
The short version
Ransomware gangs are not hand-picking you. They scan the whole internet for the same few weaknesses and break into whoever has them, from a law firm in Melbourne to a builder in Cairns. Most small business attacks are stopped by four things: multi-factor authentication on email and remote access, prompt patching of anything facing the internet, backups the attacker cannot delete, and a plan for the first hour.
On this page
How ransomware gets in
Nearly every attack starts through one of a handful of doors. None of them need a sophisticated attacker; they need one account or one device that was left open.
| The door | What it looks like | What closes it |
|---|---|---|
| Stolen or reused passwords | A staff password leaked from another website, or phished with a fake Microsoft 365 sign-in page, is used to log in to email or remote access. | Multi-factor authentication on every account that can be reached from the internet, starting with email. |
| Exposed remote access | Remote Desktop (RDP) or an old VPN open to the internet, so anyone can try passwords against it all day. | Take RDP off the internet. Put remote access behind a VPN or gateway with multi-factor authentication. |
| Unpatched edge devices | A firewall, VPN appliance or file-sharing server with a known flaw that the gangs exploit within days of it being published. | Patch internet-facing devices within 48 hours of a critical fix. Replace devices the vendor no longer supports. |
| Phishing attachments and links | An invoice, a parcel notice or a shared document that installs a remote access tool when opened. | Email filtering, Office macros blocked from the internet, and staff who know they can report a mistake without being blamed. |
| Your IT provider or a supplier | Attackers get into a managed service provider, or into the remote support tool it uses, and reach every customer at once. | Know what access your provider has, insist it uses multi-factor authentication, and ask how it would detect misuse. |
Once inside, the pattern is the same: they move from the first computer to an administrator account, find and delete the backups, copy your data out, and only then encrypt. That is why the backups and admin accounts matter as much as the front door. For which groups are currently claiming Australian victims, see our live ransomware in Australia analysis.
Ten things to do this month
In rough order of how much attack each one stops for the effort. Most need no new software, only settings you already pay for.
- Turn on multi-factor authentication for email, Microsoft 365 or Google Workspace, remote access, accounting software and banking. An authenticator app or passkey beats a text message.
- Get Remote Desktop off the internet. If you are not sure whether it is exposed, ask your IT provider for the answer in writing.
- Patch anything facing the internet first: firewalls, VPNs, routers, websites and file-sharing servers. Then laptops, browsers and Office. Turn on automatic updates wherever you can.
- Keep one backup offline or unchangeable, and do a test restore. See backups that survive below.
- Separate admin accounts. Nobody reads email or browses the web while logged in as an administrator. Fewer admins means fewer accounts worth stealing.
- Remove old accounts for staff who have left and for suppliers you no longer use.
- Block Office macros from the internet and stop staff installing software without approval.
- Check payment changes by phone. Any request to change bank details or pay urgently is confirmed on a number you already have, not one in the email.
- Ask your IT provider three questions: what access do you have to our systems, is it protected by multi-factor authentication, and how would we know if someone else used it?
- Write a one-page plan: who to call, who can make decisions, where the backups are and how to reach your insurer. Print it. Your computers may not be available when you need it.
These line up with ASD's Essential Eight, the baseline the Australian Signals Directorate recommends for every organisation. If you want to go further, our ASD Essentials guide covers what replaces it.
Backups that survive an attack
The gangs know backups are how you avoid paying, so they look for them first. A backup on a drive that is always plugged in, or in a cloud folder that syncs, is usually encrypted or deleted along with everything else.
- Three copies, two kinds of storage, one offline. At least one copy is disconnected, or held in storage that cannot be changed or deleted for a set period (often called immutable).
- Separate credentials. The account that manages backups is not one of your everyday admin accounts, and it has its own multi-factor authentication.
- Cloud services need backing up too. Microsoft 365 and Google Workspace keep your files available, but deleted or encrypted data is not always recoverable once their retention runs out. A third-party backup closes the gap.
- Test a restore every quarter: one folder, one mailbox, one whole computer. Time it. The time it takes is the time your business is down.
- Back up what you need to run, not just files: accounting data, line-of-business systems, and the settings you would need to rebuild.
If you are hit: the first hour
A ransom note on screen, files with strange extensions, or a call from someone claiming to have your data. What you do in the first hour decides how much you lose.
- Disconnect, do not switch off. Unplug network cables and turn off Wi-Fi on affected computers. Leaving them powered on keeps evidence that helps responders work out how the attackers got in.
- Call for help. The Australian Cyber Security Hotline is 1300 CYBER1 (1300 292 371), open 24 hours. Report the attack through ReportCyber. If you have cyber insurance, call your insurer early: most policies name the responders they will pay for.
- Do not contact the attackers yourself and do not delete the ransom note. It identifies the group, which tells responders what to expect.
- Change passwords from a clean device, starting with email and admin accounts, and keep a written log of what you did and when.
- Do not restore yet. Restoring before you know how they got in usually means being encrypted again within days.
What you must report
Several Australian obligations can apply after a ransomware attack. Which ones apply depends on your size, your sector and what was taken.
| Obligation | Who it applies to | What and when |
|---|---|---|
| Ransomware payment report | Businesses with annual turnover over A$3 million, and responsible entities for critical infrastructure assets (Cyber Security Act 2024). | Report to ASD within 72 hours of making a ransom payment, or of finding out one was made on your behalf. |
| Notifiable data breach | Businesses covered by the Privacy Act: generally annual turnover over A$3 million, plus some smaller ones, such as health service providers. | If personal information was taken and serious harm is likely, notify the OAIC and the people affected. Assess a suspected breach within 30 days. |
| Critical infrastructure incident | Responsible entities under the SOCI Act. | 12 hours for a significant impact, 72 hours for a relevant impact. See our SOCI Act guide. |
| Prudential notification | APRA-regulated entities. | Notify APRA under CPS 234. See our APRA CPS guide. |
Even if none of these apply, reporting through ReportCyber is worth it: it gets you advice, and it helps ASD warn other businesses about the same group.
Should you pay?
The Australian Government advises against paying, and there are practical reasons beyond principle:
- Paying does not guarantee your files back. Decryption tools are often slow or broken, and you still have to rebuild.
- Paying does not delete stolen data. Groups that promise to delete it have been caught selling it or coming back for a second payment.
- Paying can be a crime. Some groups and their members are under Australian sanctions, and paying them can breach sanctions law.
- Paying marks you. A business known to pay is more likely to be hit again.
If you are considering it, get legal advice and an incident responder involved first, and remember the 72-hour payment report above.
Get help or get tested
Both services are delivered by BugXHunter, which is run by Cintelis, the company behind CISO AI. Wherever you go for help, the steps on this page apply.
Questions
Are small businesses really targeted by ransomware?
Yes. Most ransomware is opportunistic: gangs scan for exposed remote access, unpatched devices and stolen passwords and attack whoever has them, whatever their size. Small businesses often have less protection and fewer backups, which makes them easier to hit.
What is the best ransomware protection for a small business?
There is no single product. The measures that stop most attacks are multi-factor authentication on email and remote access, prompt patching of internet-facing devices, a backup kept offline or unchangeable and tested regularly, and a written plan for the first hour of an attack.
Does antivirus stop ransomware?
Not on its own. Modern endpoint protection helps, but attackers who log in with a stolen password often disable it before encrypting. It works best alongside multi-factor authentication, patching and protected backups.
Who do I call if my business is hit by ransomware in Australia?
Call the Australian Cyber Security Hotline on 1300 292 371 (1300 CYBER1), open 24 hours, and report through ReportCyber at cyber.gov.au. Call your cyber insurer if you have one, and an incident response provider to contain the attack and recover.
Do I have to report a ransomware payment?
If your business has annual turnover over A$3 million, or is a responsible entity for a critical infrastructure asset, you must report a ransomware payment to ASD within 72 hours under the Cyber Security Act 2024.