Ransomware: why you shouldn't wipe and rebuild straight away

When ransomware hits, every hour of downtime costs money. So the natural instinct is to wipe the affected machines, restore from backup and get back to work.

Getting back to work matters. But rebuilding before anyone has preserved the evidence can leave you unable to answer the questions that come next.

The questions you will be asked

Within days of a ransomware attack, someone will ask:

• How did they get in? Your insurer will want to know. So will your board. If you can’t answer it, you can’t be sure you’ve closed the door.
• How long were they inside? Attackers are often in a network well before the encryption starts.
• What did they take? Many ransomware groups copy data before encrypting it, then threaten to publish it. Whether personal information left your network decides whether you have notification obligations.
• Are they still there? Restoring from backup doesn’t help if the attacker still has a valid account or a way back in.

The answers live on the affected systems: in logs, memory, user accounts and the traces attackers leave behind. Wipe those systems and the answers go with them.

What to do in the first hour

1. Isolate, don’t power off. Unplug network cables or turn off Wi-Fi on affected machines. Leave them running if you can. Some evidence exists only in memory and disappears on shutdown.
2. Protect your backups. If any backups are still intact, disconnect them so they can’t be encrypted too.
3. Don’t contact the attackers yet. Replying or paying has legal, insurance and practical consequences. Get advice first.
4. Notify your insurer. If you have cyber insurance, most policies require early notification and some specify who you must use.
5. Call for help. Bring in an incident response team before anyone starts rebuilding.

Recovery and investigation can run together

This isn’t a choice between getting back to business and investigating. Done well, they run in parallel. Evidence is captured from the systems that matter, then your IT team rebuilds with confidence. They know what to fix, and that the backups they’re restoring are clean.

Reporting

Ransomware can be reported to the Australian Signals Directorate’s ACSC through cyber.gov.au. If your business turnover is $3 million or more, or you’re responsible for critical infrastructure, and a ransom is paid, the Cyber Security Act 2024 requires the payment to be reported to the ASD within 72 hours. You may also have obligations under the Notifiable Data Breaches scheme. Your lawyer can advise. A forensic investigation gives them the facts to work with.

If you’re dealing with ransomware now, call Flare on 1300 027 401. The line is answered 24/7. See also our ransomware response page and the first-hour checklist.