Ransomware and breach recovery in Adelaide
If your files are encrypted, an email account has been taken over or something just looks wrong, the first hours matter. We help you contain it, work out what was reached, get the business running again from clean backups and close the way in. If it's happening right now, call us on (08) 7123 0805.
Last updated
The short answer
Ransomware and breach recovery is the work of getting a business back after a cyber attack. WaTo Consulting in Adelaide isolates affected systems, preserves evidence, finds how the attacker got in and what they reached, restores from clean backups or rebuilds machines, resets accounts, closes the gap and helps you with reporting obligations. Call (08) 7123 0805 if it's happening now.
What does recovery involve?
Recovery has four parts that overlap. Containment stops the damage spreading: disconnecting affected machines, disabling compromised accounts and cutting off remote access. Investigation works out how they got in, what they touched and whether data was taken. Restoration brings systems back from backups that are known to be clean, or rebuilds them from scratch. Hardening closes the way in and adds the controls that would have stopped it, such as multi-factor sign-in, patching and separated backups. Throughout, you need records for your insurer and any reports you have to make.
What we deliver
Fast containment
Affected machines isolated, compromised accounts locked and remote access cut, so the attack stops spreading.
Evidence kept
Logs and affected systems preserved before anything is wiped, for your insurer, the police and any investigation.
Finding the way in
How the attacker got in and what they reached, so the same door isn't left open after you're running again.
Clean restore
Systems restored from backups checked to be clean, or rebuilt where they can't be trusted, in the order the business needs them.
Accounts and email secured
Passwords reset, sessions ended, mailbox rules checked and multi-factor sign-in turned on everywhere.
Reporting support
Help with what to tell your insurer, the Australian Cyber Security Centre, customers and, where it applies, the privacy regulator.
Who it's for
- Businesses whose files or servers have been encrypted by ransomware.
- Anyone whose email account has been taken over or used to send fraudulent invoices.
- Businesses that have found an unknown login, unexpected payments or data that shouldn't be public.
- Clients of another IT provider who need extra hands during an incident.
How the job runs
- You call us. Don't turn things off or wipe anything yet. Disconnect affected machines from the network if you can, and call (08) 7123 0805.
- We contain it. Remotely or on site, we isolate systems, lock accounts and stop the spread.
- We investigate. What happened, how they got in and what was reached, written down as we go.
- We restore. Clean backups or rebuilds, in the order that gets you trading again soonest.
- We close the gap. Fix the way in, add the missing controls and give you a short report of what happened and what changed.
Why WaTo for incident recovery
- Adelaide-based since 2001, so we can be on site, not just on the phone.
- We restore from clean backups and rebuild where needed, rather than hoping a cleaned machine is safe.
- Plain-English updates through the incident, so you can make business decisions.
- Records kept for your insurer and any reporting.
- After recovery, we help you put the plan in place so the next one is smaller or doesn't happen.
Ransomware and breach questions
Should we pay the ransom?
The Australian Government advises against paying. Payment doesn't guarantee your files back or that stolen data is deleted, and it marks you as a business that pays. Businesses with an annual turnover over $3 million must also report a ransom payment to the government. Talk to us and your insurer before deciding anything.
What should we do right now?
Disconnect affected machines from the network, but don't turn them off or wipe them. Don't use a computer you think is compromised to change passwords. Call us, and call your cyber insurer if you have one. See think you've been hacked?
Do we have to report it?
You can report to the Australian Cyber Security Centre through ReportCyber at cyber.gov.au. If personal information is likely to cause serious harm, the Notifiable Data Breaches scheme may require you to notify the privacy regulator and affected people. We help you work out what applies.
How do we stop it happening again?
Multi-factor sign-in, patching, email filtering, separated and tested backups, and a written response plan stop most attacks or make them much smaller. See ransomware recovery planning and cyber incident response.
Services behind these jobs
- Cyber incident response
- Ransomware recovery planning
- Emergency business IT support
- Data recovery
- Backup and disaster recovery
- Managed cyber security
Guides on this topic
- What to do if you've been hacked
- Cyber incident response planning for small business
- How to test backups and recovery before an outage
Is it happening now?
Call (08) 7123 0805. Disconnect affected machines from the network, don't wipe anything, and we'll take it from there.
Mon to Fri, 8:30am to 5pm
