The First Hour After a Cyber Incident: A Calm Recovery Checklist

Start with the business, not the mystery

A suspected cyber incident can look like a locked mailbox, a supplier asking you to use new bank details, a staff login that no longer works, or a customer who received a message you did not send. The Australian Cyber Security Centre’s recovery guidance for compromised email and online accounts is built around a simple order: contain the access, protect money, then restore and report.

That order matters. If you spend the first hour hunting for the cleverest technical explanation, an attacker can keep using the same mailbox, payment instruction or password to reach more people. A small business does not need a forensic lab. It needs a short list of actions that stop the next loss.

The first-hour checklist

Work through these steps in order. Skip a step only if it clearly does not apply.

1. Name what you think happened. Write one sentence: “We think this mailbox / payment request / login is no longer under our control.” Keep it factual. Do not wait for certainty before acting.
2. Protect money first. If invoices, bank details, cards or payroll may be involved, contact your financial institution immediately. Ask them to watch for unusual transfers and to confirm any pending payments. The ACSC’s business-email-compromise recovery pages treat this as an early step, not a later one.
3. Stop further access where you can. Change the password on the affected account, sign out other sessions if the service allows it, and turn on or check multi-factor authentication. Review recovery email addresses and phone numbers. If you cannot get in, use the provider’s account-recovery path rather than guessing.
4. Look for what the attacker changed. In email, check inbox rules, forwarding, blocked senders, sent mail and delegated access. In other accounts, look for new users, changed payment details, new recovery methods and unexpected administrator actions.
5. Warn the people who may be next. Tell staff, suppliers or customers if they may receive a fake invoice, a changed-bank-details request or a message from your address. Use a channel you still trust, not the compromised mailbox alone.
6. Record what you did. Note times, accounts, people contacted and any payments that may have gone the wrong way. This helps your bank, insurer, IT helper and any later report.
7. Report through official channels. Use ReportCyber at Cyber.gov.au for the cyber incident. If a scam or fraud is involved, Scamwatch is the consumer-facing reporting path. If personal information may have been exposed, consider whether the OAIC notifiable data breach process applies.

What “containment” looks like in a small team

Containment is not the same as a full rebuild. For a typical Australian microbusiness it usually means:

• locking the affected mailbox or cloud account;
• pausing payments that rely on recently changed details;
• telling the person who pays invoices not to action anything unusual until it is checked;
• removing unexpected forwarding, rules or extra users; and
• keeping one trusted device or login path for recovery instead of trying every computer at once.

Cyber.gov.au’s recovery guidance for email and online-account compromise emphasises changing credentials, checking recovery options and reviewing account settings before you assume the problem is over. That is enough for the first hour. Deep log review can wait.

When a customer or supplier should be told immediately

Do not wait for a polished statement. If someone else may act on a fake message from you, they need a short, practical warning now.

Tell them:

• which address or account may have been misused;
• what they should not do — for example, do not pay a new invoice or change bank details from that message;
• how they should check with you instead, using a known phone number or another trusted channel; and
• that you are working through recovery and will confirm when the channel is safe again.

This is the same principle as invoice-fraud checks: verify through a channel you already trust, not through the suspicious message itself.

Reporting without drowning in process

Official reporting is useful even when you are not sure how serious the incident is. ReportCyber gives Australian businesses a single place to report cybercrime and get recovery direction. Scamwatch is the better fit when the issue is a scam pattern affecting customers or payments. Your bank still needs a direct call if money may already be moving.

Privacy is a separate question. The Office of the Australian Information Commissioner explains that a notifiable data breach can arise when personal information is accessed, disclosed or lost in a way that is likely to cause serious harm, and the organisation is covered by the Notifiable Data Breaches scheme. Many small businesses are not APP entities, but some are — especially if they handle health information, or if they are otherwise covered by the Privacy Act. If customer or staff personal information may have been exposed, do not guess from memory. Check the OAIC guidance and get advice if needed.

Reporting is not an admission that you failed. It is how banks, customers and later investigators understand the timeline.

What can wait until after the first hour

These tasks matter, but they should not delay containment:

• rewriting every password in the business;
• buying new software;
• writing a full incident report;
• deciding whether to change providers; and
• trying to reconstruct every attacker action.

Once access is stopped and money is protected, you can restore mail, review devices, strengthen multi-factor authentication and look at why the first account was easy to reuse. Those are second-hour and second-day jobs.

A one-page recovery card you can keep nearby

Put these contacts on one sheet, not in the mailbox that might be unavailable:

• bank fraud or business-support number;
• email or cloud provider recovery path;
• who can approve pausing payments;
• who warns staff, suppliers and customers;
• ReportCyber: cyber.gov.au/report-and-recover/report; and
• Scamwatch: scamwatch.gov.au.

If that card exists before an incident, the first hour is calmer because nobody has to invent the order under pressure.

Sources and further reading

• Cyber.gov.au — Recover from business email compromise
• Cyber.gov.au — Recover from email and online account compromise
• Cyber.gov.au — Report a cybercrime or incident
• Cyber.gov.au — Help during a cyber security incident
• Scamwatch — Report a scam
• OAIC — Notifiable data breaches

Frequently asked questions

Should we keep using the affected mailbox to warn people?

Use it only if you have already contained it and you have no better channel. Prefer a known phone number, a second mailbox or a face-to-face check. Attackers often keep watching a compromised inbox.

Do we have to report every suspicious login?

No. Report when there is a real business impact, suspected fraud, customer exposure or continued unauthorised access. When in doubt, ReportCyber is the safer official starting point.

Does a small business always have to notify the OAIC?

No. The Notifiable Data Breaches scheme applies to organisations covered by the Privacy Act, including many businesses with more than $3 million turnover and some smaller organisations that handle particular kinds of personal information. Check the current OAIC guidance rather than assuming you are in or out.

Keep going

If you want a short, practical session for the people who actually pay invoices and reset passwords, see our cyber safety training. For questions about courses or on-site sessions, use Contact Us.