After an incident
Think your app or website has been hacked? Do this first
The first hour after discovering a breach matters, and the instinct to delete everything and start again usually makes things worse. The aim is to stop the damage, keep the evidence, get the right help and meet your obligations. This page covers the first steps for a business or startup in Australia, and what the clean-up involves after.
Rather just ask someone? Talk to usIn short
Contain it first: change passwords and revoke keys for affected accounts, and take compromised systems offline without destroying evidence. Call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), available 24/7, and your cyber insurer if you have one. If personal information may be affected, assess whether you must notify under the Notifiable Data Breaches scheme.
General information, not legal advice, current as at November 2026. We're not an emergency incident response service; for an active attack, call 1300 CYBER1 and your insurer first. We help in business hours with the technical clean-up and with making sure it doesn't happen the same way again.
- What is the Notifiable Data Breaches scheme?
- The part of the Privacy Act that requires covered organisations to notify the OAIC and affected people when a data breach is likely to cause serious harm. If you suspect a breach, you must assess it within 30 days, and notify as soon as practicable if it qualifies. Most businesses with turnover over $3 million are covered, and some smaller ones too.
What actually matters
Contain, but don't wipe
Change passwords, revoke API keys and sessions, and disable compromised accounts. Take a system offline if it's actively being misused. Don't delete logs, reinstall servers or restore over the top of the evidence before someone has looked, because you'll need it to know what was taken.
Call the people whose job it is
The Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371), is free and open 24/7, and incidents can be reported at cyber.gov.au. If you have cyber insurance, call the insurer early; many require you to use their incident response panel.
Work out what was reachable
Which systems, which data, whose personal information, and for how long. Provider logs, database logs and hosting logs are the starting point. The answer decides whether you have to notify anyone, and what to tell customers.
Know your obligations
Covered businesses must assess a suspected data breach within 30 days and notify the OAIC and affected people if serious harm is likely. Businesses with turnover over $3 million that pay a ransom must report the payment to ASD within 72 hours, under the Cyber Security Act 2024.
Fix the cause, not just the symptom
Restoring the site without closing the hole that let the attacker in invites a repeat. The clean-up means finding the entry point, closing it, rotating every credential that could have been seen, checking for anything the attacker left behind, and restoring from a known-good point.
Tell customers plainly
If customers are affected, tell them what happened, what data was involved, what you've done and what they should do, such as changing a reused password or watching for scams. Clear and early beats vague and late.
The first hour
Write down times and actions as you go. You'll need the record later.
- Change passwords and revoke keys and sessions for affected accounts
- Isolate systems that are being actively misused, without wiping them
- Call 1300 CYBER1 (1300 292 371), and your cyber insurer if you have one
- Preserve logs and take screenshots of anything unusual
- Start a written timeline of what you found and did, and when
- Begin assessing whether personal information was involved
Where we'd point you elsewhere
If an attack is still underway, or ransomware is spreading through your network, you need a dedicated incident response firm, usually through your insurer or the ACSC, not a software studio. Where we come in is afterwards: finding and closing the hole in the application, rotating secrets, repairing the site or app, and reviewing the rest so the same thing doesn't happen twice.
Tell us what you'd like checked
Describe what you run and what's worrying you. We'll suggest a sensible scope and a fixed price, or tell you plainly if a different kind of specialist would serve you better.
Common questions
ASD's Australian Cyber Security Centre, through cyber.gov.au or the 24/7 hotline on 1300 CYBER1 (1300 292 371). If personal information was involved and your business is covered by the Privacy Act, you may also need to notify the OAIC. Scams and fraud can also be reported to your bank and to Scamwatch.
If your business is covered by the Privacy Act and the breach is likely to cause serious harm, yes: you must notify the OAIC and the affected people. Even when it's not legally required, telling customers plainly is usually the right call.
The Australian Government strongly advises against it, because payment doesn't guarantee data is returned or deleted. If a business with turnover over $3 million does pay, it must report the payment to ASD within 72 hours. Get advice from your insurer and lawyer before deciding anything.
Yes, once the incident is contained. We find how the attacker got in, close it, rotate credentials, repair the site or app, check for anything left behind and review the rest. We work in business hours and don't offer emergency response.
See it working
Software we'd build, running with a fictional business and sample data. Use it, then decide.
Also worth a look
- Leaked API Keys: How to Check and What to Do
- Code and Infrastructure Security Review
- How AI Is Changing Cyber Attacks on Business
- Already broken or stuck? Fix & rescue
Last reviewed . General information, not legal advice. Figures cited are from the sources named on each page.