Malware
Ransomware explained: how it works and what limits the damage
What is ransomware? How it gets in, the warning signs ASD lists, why ASD says never to pay, and the defences and recovery steps it describes.
How to protect against ransomware: what official guidance lists
ASD's guidance centres on being able to recover your files, keeping devices updated and protecting accounts. Each step links to the detail.
- Keep regular backups, stored separatelyASD says that without a backup it could be impossible to recover your files. In the case study on its ransomware page, backups were kept in the cloud, on external drives and on a network storage device.How to set up backups on each device
- Turn on automatic updatesASD's small business guide says to turn on automatic updates for devices and software, and to consider upgrading products the manufacturer no longer updates.What ASD says about updates
- Turn on multi-factor authenticationASD's small business guide says to turn on MFA wherever possible, starting with your most important accounts.How to turn on MFA
- Set security software to scan regularlyASD's small business guide describes setting up security software to complete regular scans on your devices.More on security software
- Take care with links, attachments and unknown filesThese are the routes in that ASD lists: unsafe websites, emails or files from unknown sources, and malicious links in emails or on social media.How ransomware gets in
- Know who to call: 1300 CYBER1 (1300 292 371)ASD's Australian Cyber Security Hotline is available 24/7. ASD's guidance is "Never pay a ransom."Steps after an attack
Based on ASD's ransomware page and its Small business cyber security guide (January 2025), checked October 2026.
Key points
- ASD describes ransomware as malware that locks or encrypts files so they can't be accessed, usually with a demand for cryptocurrency. Attackers may also threaten to leak or sell data.
- ASD's guidance is "Never pay a ransom." It explains there is no guarantee of getting access back, and that you may be targeted by another attack.
- Being able to restore from a backup is what makes recovery possible. ASD says that without one, recovering files could be impossible.
- If personal information was accessed, an organisation may have obligations under the Notifiable Data Breaches scheme, which the OAIC explains.
What is ransomware? The Australian Signals Directorate (ASD) describes it as a type of malware that “works by locking up or encrypting your files so you can no longer access them”. The attacker usually demands payment in cryptocurrency, and may also threaten to leak or sell the data. This guide explains how ransomware gets in, the warning signs, the defences ASD lists, and what official sources say to do after an attack.
How ransomware gets in
ASD’s ransomware page explains that it spreads like other malware. Common routes it lists include:
- visiting unsafe or suspicious websites
- opening emails or files from unknown sources
- clicking malicious links in emails or on social media.
ASD’s small business guide adds that malware can come from infected websites, downloads or email attachments, and that phishing typically compromises account passwords. The same guide describes auditing and securing internet-exposed services, such as Remote Desktop, file shares, webmail and remote administration.
Warning signs ASD describes
ASD lists signs such as:
- pop-up messages requesting funds or payment to unlock files
- being unable to access a device, or logins failing for unknown reasons
- files asking for a password or code to open
- files moved from their usual locations
- unusual file extensions, or changed names and icons.
How to reduce the risk: defences ASD lists
Backups
ASD’s ransomware page says: “If you don’t have a backup, it could be impossible to recover your files.” Its small business guide describes creating and implementing a plan to back up information regularly. See how to set up backups on phones and computers, or for organisations, Microsoft 365 backup. The backup readiness checklist is a quick way to see what’s covered.
Updates
The small business guide says to “Turn on automatic updates for your devices and software”, and, where a manufacturer has stopped providing updates, to consider upgrading to a newer product. The Windows and Mac guides show where the update settings are.
Multi-factor authentication
The small business guide says to “Turn on MFA wherever possible, starting with your most important accounts”. See how to turn on multi-factor authentication.
Security software
The small business guide describes setting up security software “to complete regular scans on your devices”. In the case study on ASD’s ransomware page, the business’s IT professional updated its anti-virus software after the attack. For what Windows and Macs already include, see the antivirus software guide.
Care with links and attachments
The routes ASD lists (unsafe websites, emails or files from unknown sources, and malicious links) are the same ones covered in phishing explained.
For organisations, ASD’s Essential Eight includes patching, restricting administrative privileges, multi-factor authentication and regular backups among its eight strategies.
What ASD says about paying
ASD’s guidance is direct: “Never pay a ransom.” It explains that “There is no guarantee you will regain access to your information”, and that “You may also be targeted by another attack.” ASIC’s guidance for businesses says the same: “If a scammer asks you to pay a ransom, never do so.”
What ASD describes doing after an attack
ASD’s ransomware page includes a case study that describes these steps:
- Disconnecting affected devices from the network.
- Taking a screenshot of any ransom note.
- Running anti-malware and anti-virus scans on all machines.
- Calling the Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371), available 24/7, for advice.
- Consulting an IT professional, who may reformat systems to remove the ransomware and update security software.
- Restoring files from regular backups (in the case study, kept in the cloud, on external drives and on a network storage device) and reinstalling software.
A business can write these contacts down in advance using a one-page cyber incident response plan template.
Data breach obligations
If personal information was accessed in an attack, an organisation may have notification obligations. The OAIC explains that under the Notifiable Data Breaches scheme, any organisation or agency the Privacy Act 1988 covers must notify affected individuals and the OAIC when a data breach is likely to result in serious harm. ASIC’s guidance says to “Seek legal advice regarding reporting obligations”. See how the Notifiable Data Breaches scheme works.
Where to report and get help
- ASD’s Australian Cyber Security Hotline: 1300 CYBER1 (1300 292 371), 24/7.
- ReportCyber: ASIC’s guidance for businesses lists reporting cybercrime through ReportCyber, which passes reports to the relevant police jurisdiction.
- IDCARE: free identity and cyber support (individuals 1800 595 160, small business 1800 595 170).
Where to report scams and cybercrime in Australia covers each service.
Common questions
What is ransomware?
Ransomware is malware that locks or encrypts files so they can’t be accessed, usually followed by a demand for payment in cryptocurrency. ASD describes it as malware that “works by locking up or encrypting your files so you can no longer access them”. The attacker may also threaten to leak or sell the data. It spreads like other malware, through unsafe websites, unknown files and malicious links. See how ransomware gets in.
Should I pay the ransom?
ASD’s guidance is direct: “Never pay a ransom.” It explains that “There is no guarantee you will regain access to your information”, and that “You may also be targeted by another attack.” ASIC’s guidance for businesses says the same: “If a scammer asks you to pay a ransom, never do so.” See what ASD says about paying.
How do I protect my computer or business from ransomware?
The defences ASD lists centre on being able to recover. ASD says: “If you don’t have a backup, it could be impossible to recover your files.” Its small business guide also describes turning on automatic updates, turning on multi-factor authentication wherever possible, and setting security software to complete regular scans. See how to reduce the risk.
What do I do if I’ve been hit by ransomware?
The case study on ASD’s ransomware page describes disconnecting affected devices from the network, taking a screenshot of the ransom note, running anti-malware scans, and calling the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), available 24/7. An IT professional then removed the ransomware and files were restored from backups. See what ASD describes doing after an attack.
Can I get my files back without paying?
ASD says that without a backup, recovering files may be impossible. The case study on its ransomware page describes an IT professional reformatting systems to remove the ransomware, then the files being restored from regular backups kept in the cloud, on external drives and on a network storage device. See backups and how to set up backups.
Does a ransomware attack have to be reported to the OAIC?
It depends on the organisation and what was accessed. The OAIC explains that organisations covered by the Privacy Act 1988 must notify affected individuals and the OAIC when a data breach is likely to result in serious harm. ASIC’s guidance says to “Seek legal advice regarding reporting obligations”. See data breach obligations.