Skip to content
Cyber Security

Hit by a cyber attack in WA? Who to call and what to do first

A first-hours guide for Perth and WA organisations hit by ransomware, a hacked mailbox or a scam: what to do first, and who to report it to.

Geidi Security Operations Team7 min read

In brief

What it is
A first-hours guide for Perth and WA organisations hit by ransomware, a hacked mailbox or a scam: what to do first and who to call.
Who it affects
Any WA organisation where money has gone, files are locked or someone gave their password away.
What to do
Contain it and keep the evidence, call your IT provider, then your bank if money moved, then report to ReportCyber or 1300 CYBER1.
On this page
  1. The first hour: contain it, and keep the evidence
  2. Who to call first, in this order
  3. What about WA Police?
  4. The reports that come next
  5. Put this on one page before you need it
  6. Where Geidi fits
  7. Sources

It's 4pm on a Thursday in Perth. The bookkeeper says a supplier payment went to an account nobody recognises. Or the file server is full of renamed files and a note asking for Bitcoin. Or a staff member admits they typed their password into a page that wasn't Microsoft. Someone asks the obvious question: who do we call?

There are more answers than people expect, and they don't all matter in the first hour. This guide puts them in order for a Perth or WA organisation: what to do straight away, who to ring first, and which reports can wait until the dust settles. It isn't legal advice, and it doesn't replace an incident response plan. If you don't have one, this is a reasonable skeleton for it.

The first hour: contain it, and keep the evidence

Disconnect, don't wipe. Pull the network cable or turn off Wi-Fi on affected computers, and have your IT provider block them at the firewall if they can. Resist the urge to switch everything off, run a "cleaner" or reinstall Windows. Memory, logs and the malicious files themselves are how anyone works out what happened, and a rebuilt laptop tells nobody anything.

Protect the backups. If your backup storage looks untouched, get it off the network now. Attackers go after backups because backups are what make a ransom pointless.

For a hacked mailbox, reset the password, sign the account out of every session, and look for inbox rules nobody created. Don't delete the phishing email or the rules: screenshot them first, then remove them. Our guide to business email compromise covers the mailbox checks in more detail.

Talk out of band. Assume the attacker can read your email and Teams. Use phone calls, and a group chat on personal phones, for anything about the response.

Start a log. One person writes down what happened, what was done, by whom, and when. Photograph ransom notes and odd screens. Your insurer, your lawyer and any regulator will ask for this later, and memory is unreliable by Monday.

Who to call first, in this order

  1. Your IT provider or IT team. They can isolate systems, preserve evidence and tell you what you're actually dealing with. If you have cyber insurance, call the insurer's incident line straight after: many policies expect early notice and have their own panel of responders.
  2. Your bank, if money has moved. This is the call where minutes count. Scamwatch's advice is to contact your bank or card provider straight away and tell them to stop any transactions, and the WA Government's cybercrime page says the same: if money was lost, notify your bank immediately. Ask them to recall the payment and contact the receiving bank.
  3. ReportCyber, run by the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC). Report online at cyber.gov.au (opens in a new tab), or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), which answers 24 hours a day, 7 days a week. The hotline takes reports of cybercrime and cyber security incidents, and can check on a report you've already made. Online, most businesses choose "Cybercrime", which covers hacked devices, systems and accounts as well as scams. "Cyber security incident" is only for organisations with 250 or more staff or $250 million turnover, government departments, critical infrastructure and regulated entities.

What about WA Police?

For most cyber attacks on a business, ReportCyber is the police report. The WA Government says all cyber enabled crime must be reported through ReportCyber, which refers each report to the most appropriate agency in Australia. In WA that can mean WA Police. You don't need to ring 131 444 as well for a hacked mailbox, a fake invoice or ransomware.

The exception is anything with an imminent risk of harm to a person: threats of violence, family and domestic violence, or child exploitation and abuse, including intimate images. Those go straight to WA Police on 131 444 or at a local police station. In a life-threatening emergency, call 000. If a staff member is being blackmailed with images, treat it as this kind of matter, not as an IT ticket.

The reports that come next

Once the incident is contained and the first calls are made, work through these. Some are optional and helpful. Two are legal obligations with deadlines.

Scamwatch, if it was a scam

If you were tricked rather than hacked, for example a fake supplier, a fake bank call or a fake invoice, report it to Scamwatch through its online form as well. Scamwatch uses reports to warn others. If money or personal information was stolen, Scamwatch itself points victims to ReportCyber for the police report, so do both.

IDCARE, for identity problems

If a staff member's or customer's identity documents, licence or Medicare details were exposed, IDCARE, the national identity and cyber support service, helps people work out what to do next. Its individual helpline is 1800 595 160, or 08 7078 7741 for WA, Monday to Friday 7am to 7pm AEST (5am to 5pm Perth time). It also runs a Small Business Cyber Resilience Service, funded by the Australian Government, which offers free support to small businesses recovering from a cyber incident.

The OAIC, if personal information was involved

If personal information was accessed or taken, you may have an eligible data breach under the Privacy Act. If you suspect one, you have 30 days to assess it. If it is one, you notify the people at risk and the Office of the Australian Information Commissioner (OAIC), through the OAIC's online Notifiable Data Breach form, as soon as practicable. Not every business is covered, so check. Our article on notifiable data breaches explains the test and who it applies to.

The 72-hour ransomware payment report

If a ransom is paid, by you or on your behalf, and you're a "reporting business entity", you must report the payment to ASD within 72 hours of the payment, or of finding out someone paid for you. This has applied since 30 May 2025, under Part 3 of the Cyber Security Act 2024.

You're a reporting business entity if you carry on business in Australia and either had annual turnover of more than $3 million in the previous financial year or are a responsible entity for a critical infrastructure asset. Commonwealth and state bodies are not covered by this obligation. The report is made through cyber.gov.au.

The government's advice is not to pay. Paying doesn't guarantee you get your data back or that stolen data stays unpublished. If anyone in your organisation is weighing it up, get legal advice before money moves, not after.

WA public sector entities: report to DGov

WA government agencies have their own extra obligation. Under the WA Whole-of-Government Cyber Security Incident Coordination Framework, entities must report cyber security incidents to the Office of Digital Government (DGov) and to the WA Police Force's Technology Crime Services. The framework covers the WA public sector, Schedule 1 entities such as the WA universities and government trading enterprises, and health service providers, and local governments are expected to comply too.

Agencies report through the WA Government Cyber Security Incident Reporting Portal run by DGov's Cyber Security Unit. Agencies without access request it by emailing cybersecurity@dpc.wa.gov.au. If you're an agency, the time to check your login works is now.

Put this on one page before you need it

Most of what makes the first hours go well is decided in advance. Write a single page with your IT provider's after-hours number, your insurer's incident line, your bank's fraud number, 1300 CYBER1 and the name of who makes the call on each. Print it. When the network is down, a document on the file server is no help.

Where Geidi fits

Geidi is a Perth-based IT provider in Bentley, operating since 2000, for organisations of 5 to 1,000 staff. Our cyber security service includes a 24/7 security operations centre, with security practices aligned to Essential Eight, ISO/IEC 27001 and SMB1001. If you'd like help writing your one-page incident plan, talk to us.

Sources

More on Cyber Security

One partner for the whole environment.

Tell us about your existing IT. We would be pleased to review your current system and give you an overview as to how Geidi may be able to deliver and enhance your IT operations.

Book a consultationCall 1300 855 049