Ransomware: What to Do Right Now (Australian Home Guide)
If a message on your screen says your files are locked and demands payment, stay calm and act in this order: photograph the message, turn off the affected device, disconnect everything else on your network, do not pay, and report it. Then get help to clean the device and restore your files from a backup you trust. This guide walks through each step in plain English, written for households and home offices in Brisbane, Logan, Ipswich and Redlands, and for anyone else in Australia.
TL;DR
Photograph the ransom note and any odd file names or extensions first, then switch the infected device off.
Disconnect other devices on the same Wi-Fi or network, and do not plug in your backup drive yet.
Do not pay. The Australian Cyber Security Centre (ACSC) advises against it, because paying guarantees nothing.
Report through ReportCyber, and call the ACSC hotline on 1300 CYBER1 (1300 292 371) for help at any hour.
Wipe and rebuild the device before restoring from a clean backup, and change your important passwords from a safe device.
Table of Contents
What ransomware actually is
Ransomware is malicious software that locks your files, or your whole device, and then demands money to give them back. It usually arrives through a dodgy email attachment, a link in a text message, a fake download or a compromised website. Sometimes it turns up after someone has phoned you pretending to be from your internet provider or a software company and talked you into installing “support” software.
On a home computer the signs are usually hard to miss:
A full-screen message or a text file demanding payment, often in cryptocurrency.
Photos, documents and spreadsheets that will not open, or that have strange new file endings.
A countdown timer or a threat that your files will be deleted or published.
A computer that has become very slow right before the message appeared.
Some attackers also steal copies of your files before locking them. That matters, because it changes what you need to do afterwards, and we cover it in the section on personal information below.
The first ten minutes: what to do in order
Speed matters, but order matters more. Do these steps in sequence.
1. Record what you can see
Before you touch anything, take photos of the screen with your phone. Capture the ransom note, any email address or website it mentions, and any new file extensions on your documents. The ACSC’s ransomware guidance tells people to record these details first, because they help professionals identify the type of attack and support police reports and insurance claims later.
Do not type anything into the ransom note, click its links or contact the people behind it.
2. Turn off the infected device
For a home user, switching the affected computer off is generally the best immediate way to stop the damage spreading, according to the ACSC. Hold the power button if the screen is frozen. Do not restart it “to see if it fixes itself”, and do not run random clean-up tools you find online.
3. Disconnect everything else on the network
Ransomware can move from one device to another over your home network. Turn off or disconnect the other computers, laptops, phones, tablets and any network storage (NAS) drives that share your Wi-Fi or are plugged into your router. If you are not sure whether a device is affected, treat it as if it is until someone has checked it.
If you cannot find every device, unplug the router for now. You can bring it back later once the devices are sorted.
4. Keep your backups away from the mess
This is the step people get wrong most often. Do not plug your backup drive into the infected computer, and do not connect it to any device on the affected network yet. If the backup was connected when the attack happened, it may be affected too. In that case, leave it alone and get professional help before you touch it.
5. Use a different, clean device to get help
Use your phone on mobile data, or a computer you are certain is clean and on a different network, to look up numbers, contact your bank and report the incident. Avoid logging into important accounts from the affected device or network.
What not to do
A few well-meant reactions make ransomware worse:
Do not delete the ransom note or the encrypted files. They are evidence and may help identify the type of attack.
Do not reinstall Windows or macOS straight away. A full wipe is part of recovery, but do it after you have recorded the details and confirmed what you are restoring from.
Do not contact the attackers. Replying signals that someone is paying attention and can lead to more pressure.
Do not trust “recovery” sites that appear in search ads. Scammers target people who have just been hit, offering to unlock files for a fee.
Do not keep using the computer “just to check a few things”. Every minute it stays on and connected is a chance for more files to be locked.
Should you pay the ransom?
No. The ACSC advises against paying a ransomware demand, and Victoria Police gives the same advice. The reasons are practical:
There is no guarantee you will get your files or device back. You are dealing with criminals.
Paying does not stop stolen information from being leaked or sold.
Once you have paid, you may be seen as an easy target and hit again.
It is a hard thing to hear if the locked files are your family photos or years of tax records. That is exactly why backups matter, and why a specialist can sometimes help even when you think everything is lost. If you have no backup at all, say so when you ask for help. Recovery may need specialist assistance, and the options depend on what has been affected.
If you have already paid, or sent money in any form, contact your bank or credit union immediately. Tell them what happened, and ask what they can do about the transaction and about protecting your accounts.
Who to report to in Australia
Reporting is not about blame. It helps police and the ACSC track the criminals, and it gives you a record you may need for insurers or banks.
Who | Why | How |
ReportCyber (Australian Government) | Official report of the cybercrime, which is passed to the right police agency | Online, through the ReportCyber page on cyber.gov.au |
ACSC hotline | 24/7 help with cyber security incidents | Call 1300 CYBER1 (1300 292 371) |
Scamwatch | Helps track scams, especially when a call, text or email started it | Report through the Scamwatch website |
Your bank or credit union | Protects your accounts if money was sent or card details were exposed | Call the number on the back of your card |
IDCARE | Support if your personal information is at risk from a data breach | Contact IDCARE, Australia’s national identity and cyber support service |
If the incident involved someone pretending to be Services Australia, report it to them. If you suspect identity theft or a tax-related problem, report it to the relevant agency, such as the ATO.
Write down the date, what you saw, what you clicked and any reference number you are given. Keep your phone photos from step one with the notes.
Cleaning up and recovering your files
Once the spread is contained and reported, recovery has a clear sequence. The ACSC’s approach is to get professional help where needed, make sure your backups are clean, wipe the affected drives and devices, reinstall the operating system, and only then reconnect a trusted backup and restore your information.
Check your backup first
A backup is only useful if it is free from ransomware. Ask yourself:
Was the backup drive or cloud account connected to the infected computer when the attack happened?
Does the backup contain files dated after the attack began?
Is it a copy you made some time ago that has never been attached to the affected devices?
If you are confident the backup was kept separate and is clean, it is likely your best route to getting everything back. If you are unsure, do not open it. Ask a technician to check it safely first.
Wipe and rebuild
Deleting a few suspicious files does not make an infected computer safe. The reliable approach is to erase the drive, reinstall the operating system from trusted media, reinstall your programs, and only then bring back your data. It takes longer than a quick scan, but it removes hidden leftovers that could lock your files again.
This is also the point to consider every device that was on the network. A laptop that looked fine may still carry the infection, so have them checked before they rejoin your Wi-Fi.
If there is no clean backup
Tell your technician exactly that, and show them the photos you took at the start. Specialists sometimes have options depending on the type of ransomware, but there are no promises, and anyone who guarantees to unlock any file for a fee deserves suspicion. Be careful with files that matter most, and do not keep trying random tools on the original drive, which can reduce what can be recovered.
Change your passwords and check your personal information
Assume the attackers may have seen what was on the computer. As a precaution, the ACSC advises changing important passwords, starting with cloud storage, email, banking and any business accounts. Do this from a clean device, not from the computer that was affected.
A sensible order:
Email accounts first. Whoever controls your email can reset almost every other password.
Banking and payment accounts, plus any saved cards in browsers or shopping sites.
Cloud storage such as photo and document backups.
Work or business logins, and let your employer or clients know if their data was on the device.
Everything else, using a password manager so each login is unique.
Turn on multi-factor authentication wherever it is offered, so a stolen password alone is not enough. Watch your bank and email accounts for unfamiliar activity over the next few weeks, and be wary of calls or messages that mention details only you should know, as criminals use stolen information to sound convincing.
When you rebuild, you will also be choosing which apps and services get access to your logins and payments again. Look for clear, plain-language detail about how a service stores your data and handles your credentials, such as this explanation of protecting your data, logins and payments, before you connect anything new to your accounts.
How we help at NextGen IT
If you are in Brisbane, Logan, Ipswich or Redlands, we come to you. Our technicians can look at the affected devices at your home, check whether your backups are safe to use, remove malicious software, rebuild a computer and walk you through restoring your files, explaining each step without jargon. Our “No Fix, No Fee” guarantee means you pay only when the problem is resolved, and pricing is confirmed after assessment, before any work begins.
If you are not sure what happened, or you simply want a second pair of eyes on a strange message, start with our scam protection and cyber security service. For a computer that needs to be cleaned and rebuilt, see our laptop and computer repairs, or ask about virus removal in Redlands. If you are searching for help right now, remember the ACSC hotline above is open around the clock for urgent guidance.
Protecting yourself from a repeat attack
Once your devices are clean, spend an hour making the next incident far less painful.
The backup rule that saves you
A widely used guide is the 3-2-1 rule: keep three copies of anything important, on two different types of storage, with one copy kept somewhere else, such as an offline drive stored away from the computer. The key point from the ACSC is that a backup must never have been connected to an infected device or its network, otherwise it can be affected too. Unplug external drives after each backup, and make sure at least one copy is not permanently attached to your computer or Wi-Fi.
Test your backup occasionally by opening a few files from it. A backup you have never tested is a hope, not a plan.
Everyday habits
Install updates for Windows, macOS, your phone and your router when they appear. Many attacks use known weaknesses that updates already fix.
Slow down on links and attachments. Unexpected parcel notices, invoices and “your account is locked” messages are classic bait. If in doubt, go to the company’s website by typing the address yourself.
Never let a caller take remote control of your computer, however official they sound.
Use security software and keep it switched on and current.
Use separate, strong passwords and multi-factor authentication, particularly on email.
Keep your home network tidy. An old router with default settings is an open door. Our in-home Wi-Fi and internet support can check your setup and tighten it up.
If you are unsure whether a computer problem is serious, it helps to know what a repair visit involves. Our guide to computer repair costs in Australia explains what affects the price, so there are no surprises.
A quick checklist to keep
Photograph the ransom note and any file changes.
Switch off the infected device.
Disconnect all other devices and network storage.
Keep backups unplugged and untouched.
Do not pay or reply to the attackers.
Report on ReportCyber, and call 1300 292 371 for help.
Wipe, rebuild, then restore from a backup you trust.
Change passwords from a clean device, starting with email and banking.
FAQ
What is the first thing to do in a ransomware attack?
Take photos of the ransom note and any new file extensions, then switch off the infected device. Recording the details first helps professionals and police later. After that, disconnect your other devices from the network.
Can I get my files back without paying?
Often you can, if you have a clean backup that was never connected to the infected device or network. You wipe and rebuild the device first, then restore. Without a clean backup, recovery may need specialist help, and results depend on the type of ransomware.
Should I turn off my Wi-Fi?
Disconnecting the other devices from the network is more important than the router itself, but unplugging the router is a quick way to stop anything spreading while you work out what is affected. Switch off the infected computer, then check phones, tablets, laptops and any network storage drives before reconnecting.
Who do I call for ransomware help in Australia?
Call the ACSC hotline on 1300 CYBER1 (1300 292 371), which runs 24 hours a day, and report the incident through ReportCyber. If money was lost, call your bank or credit union straight away. For hands-on help at home in Brisbane, Logan, Ipswich or Redlands, you can book a visit with us.
Is ransomware the same as a virus?
It is a type of malicious software, so it is related, but its aim is different. A typical virus damages or spies on your device, while ransomware locks your files and demands payment. Both need to be properly removed, and a rebuild is often the safest way to be sure the device is clean.
Recommended
Comments