Ransomware attacks on Australian small businesses have increased significantly in recent years. Perth businesses are not immune. This guide tells you exactly what ransomware is, how it gets in, and - most importantly - how to stop it.
What is ransomware?
Ransomware is malicious software that encrypts your files, making them inaccessible. The attackers then demand a payment - typically in cryptocurrency - to provide the decryption key. Even if you pay, there's no guarantee you'll get your files back. Ransom demands targeting Australian businesses regularly reach six figures or more.
How Ransomware Gets Into Perth Businesses
#1
Phishing emails
Staff click a malicious link or attachment
#2
Weak passwords
Attackers brute-force remote access (RDP)
#3
Unpatched software
Known vulnerabilities exploited
6 Steps to Protect Your Business
Enable Multi-Factor Authentication (MFA)
Most ransomware starts with a stolen password. MFA means a stolen password alone isn't enough to break in. Enable it on email, Microsoft 365, and any remote access tools - today.
Keep everything patched and updated
Ransomware frequently exploits known vulnerabilities in outdated software. Automate Windows updates, keep your antivirus definitions current, and don't ignore firmware updates on routers and firewalls.
Train your staff to spot phishing
The vast majority of ransomware is delivered via phishing emails. A one-hour training session that teaches staff how to recognise suspicious emails is one of the best investments you can make.
Back up your data - and test the backups
Offline or cloud backups are your last line of defence. If ransomware hits, you can recover without paying. But only if the backups actually work - test yours with a real restore every quarter.
Install proper endpoint protection
Basic antivirus isn't enough anymore. Modern Endpoint Detection and Response (EDR) tools use AI to detect unusual behaviour - like a program suddenly encrypting hundreds of files - and stop it before it spreads.
Limit who can access what
If ransomware gets into one account, it can only encrypt files that account has access to. Limiting access rights (the principle of least privilege) contains the damage if the worst happens.
All six of these protections, MFA, patching, EDR, and more, are built into our cybersecurity services for Perth businesses.
Cybersecurity Services →What to Do If You're Hit Right Now
Immediate actions - every minute counts:
- 1.Disconnect affected devices from the network immediately (pull the ethernet cable or turn off Wi-Fi)
- 2.Do NOT turn off the computer - forensic evidence may be needed
- 3.Do NOT pay the ransom without professional advice
- 4.Call your IT provider immediately - 0433 087 091 for Top Tier Computing clients
- 5.Report to the Australian Cyber Security Centre: cyber.gov.au
Frequently Asked Questions
If we're hit by ransomware, will paying the ransom get our files back?
Not reliably. Even when a payment is made, there's no guarantee the attackers actually provide a working decryption key, and paying doesn't undo the fact that your data was accessed by a third party. This is exactly why the six prevention steps, particularly tested backups, matter more than planning around a ransom payment.
We have antivirus installed, isn't that enough to stop ransomware?
Basic antivirus alone is no longer considered sufficient on its own. Modern ransomware is designed to slip past traditional signature-based detection, which is why proper endpoint protection, the kind that watches for unusual behaviour like a program suddenly encrypting hundreds of files, has become the standard alongside antivirus.
How often should we actually test our backups?
A real restore test every quarter is a reasonable baseline for most small and medium Perth businesses. A backup that's never been restored is really just an assumption, the only way to know it would actually work in an emergency is to have proven it beforehand.
What's the very first thing to do if we suspect a ransomware attack right now?
Disconnect the affected device from the network immediately, by pulling the ethernet cable or turning off WiFi, but don't turn the computer off, since forensic evidence may be needed. Then call your IT provider straight away rather than trying to handle it internally or paying anything without professional advice first.
Get a free security assessment for your Perth business
We'll review your current defences and identify gaps - before attackers do.
Book a Free AssessmentFor related reading, see our guides to Cyber Attack Response for Perth Businesses and Running an Incident Response Drill: Stress-Test Your Team First.