Flare · Ransomware

Your files are locked and there's a ransom note.

Ransomware stops a business in its tracks. Files won't open, systems won't start, and a note demands payment. In many cases the attackers have also copied data out before locking it, and threaten to publish it.

The instinct is to wipe and rebuild as fast as possible. Restoring operations matters, but rebuilding before evidence is preserved can destroy the only record of how they got in and what they took. That is what your insurer, regulators and customers will want to know.

Call 1300 027 401 (24/7) Send an enquiry

Signs of a ransomware attack

→Files have new extensions and won't open.
→A ransom note appears on screens or in folders.
→Servers or backups have stopped working or been deleted.
→Security software has been switched off.
→Unusual activity from an administrator account, often overnight or on a weekend.

Do these now

01

Isolate, don't power off

Disconnect affected machines from the network: unplug the cable or turn off Wi-Fi. Leave them running if you can. Memory holds evidence that is lost when a machine shuts down.
02

Protect your backups

Disconnect any backups that are still intact so they can't be encrypted too.
03

Don't contact the attackers

Don't reply or pay before you have advice. Payment decisions have legal and insurance implications.
04

Call your insurer and us

If you have cyber insurance, notify your insurer early. Many policies require it, and some require you to use a responder from their panel, so ask. Then call Flare on 1300 027 401.

What Flare does

How we help

Help you contain it

We work with your IT team or provider to stop the spread and confirm the attacker no longer has access.

Preserve evidence before rebuild

We capture the evidence needed to investigate, so your team can start recovery without destroying the record.

Find the way in

We establish how the attacker entered, how long they were inside, and what they accessed, so the same door isn't left open after you rebuild.

Work out what was taken

We look for signs of data being copied out. That drives decisions about notification, customer communication and your insurance claim.

You get a clear account of how the attack happened, what was affected, and what needs to change, in a report written for your board, your insurer and any regulator who asks.

Having a cyber incident?

Call now. The line is answered 24/7, and early action protects evidence and money.

Call 1300 027 401 First-hour checklist

Common questions

Should we pay the ransom?

That is a business, legal and insurance decision, and it should be made with advice. Payment doesn't guarantee your data back, or that copied data won't be published. We can give you the facts that decision needs.

Can we just restore from backup?

Often yes, but first confirm the backups are clean and that you know how the attacker got in. Otherwise you may restore the same weakness, or the attacker's access along with it.

Do we need to report it?

Ransomware can be reported to the Australian Signals Directorate's ACSC. If your business turnover is $3 million or more, or you run critical infrastructure, and a ransom is paid, the payment must be reported to the ASD within 72 hours under the Cyber Security Act 2024. You may also have Notifiable Data Breaches obligations. Ask your lawyer. Our findings support those decisions.

Testimonials

Trusted when it matters

"Mark and the team have been invaluable to me and my businesses. Their responsiveness is second to none, and their "bedside manner" is unparalleled. In the moments you need Sicarius the most, Mark and his team know you need experts that care and that is why I trust them implicitly."

Joni Pirovich

CEO · Crystal aOS

Business email compromise →Account compromise → Read: Ransomware: why you shouldn't wipe and rebuild straight away → All Flare services →