Experiencing a cyber attack?

When you call, you will speak with a security practitioner, not a call centre. If you suspect an incident but are not certain, call anyway. It costs nothing to check, and early hours matter more than any other factor in how an incident ends.

Call 1300 085 366

Facing a cyber attack?

Follw this 5-step guideline

While you reach for the phone, these steps protect your position without making things worse.

Isolate, don’t power off.

Disconnect affected systems from the network where you can do so safely, but do not power them off. Shutting down destroys evidence that we need.

Move to a clean channel.

If email or collaboration tools may be compromised, coordinate by phone or another channel the attacker cannot read.

Preserve evidence.

Keep logs, alerts and suspicious emails. Do not delete anything, and pause any scheduled jobs that overwrite or purge logs if you can.

Start a timeline.

Note what happened, when it was noticed, and every action taken since, with times. A simple timeline saves hours later.

Hold off on big moves.

Resetting passwords, restoring from backup or wiping machines before the scope is understood can tip off the attacker or destroy the recovery path.

What to have ready when you call

Don’t delay the call to gather these. Whatever you have is enough to start.

• What you are seeing and when it was first noticed

• Which systems, services or data appear to be affected

• What has already been done in response

• The best contact for decisions over the hours ahead

What happens when you call

A practitioner will triage the situation with you, help you take the immediate containment steps that fit your environment, and set out a clear plan for investigation and recovery. We tell you plainly what we know, what we don’t yet know, and what happens next.

Not an emergency?

If you are planning ahead rather than responding, our Incident Response & Resilience services cover readiness, response planning and exercises.