Getting Help After a Hack: ReportCyber, ASD and IDCARE

The Australian Cyber Security Hotline

The hotline is run by the Australian Cyber Security Centre, part of the Australian Signals Directorate. Business Queensland lists it as a hotline available at any hour on 1300 CYBER1, which is 1300 292 371 ^[1]. When it was expanded in 2021, the government described it as operating day and night, seven days a week, and said it should be the first number Australians call when they need cyber security help or advice, with small and medium businesses named as particular beneficiaries ^[2].

The Australian Cyber Security Centre's small business guide gives the same contact for reporting an incident: cyber.gov.au and 1300 CYBER1 ^[3].

Use it when: you need advice on what is happening and what to do next, especially if the incident goes beyond the website, for example to email accounts or office computers.

Reporting cybercrime

Business Queensland directs businesses to report cybercrime at cyber.gov.au/report ^[1]. Reports go to the Australian Signals Directorate's reporting service, often called ReportCyber, and are used to understand attacks and, where appropriate, referred to police.

The same reporting form is used for mandatory ransomware and cyber extortion payment reports. If your business had an annual turnover of more than $3 million in the previous financial year and made such a payment, the report is due within 72 hours ^[5].

Use it when: your website or accounts were compromised, money was demanded or taken, or data was stolen.

IDCARE

IDCARE describes itself as an independent not-for-profit and as Australia's national identity and cyber incident support service ^[4]. It offers free expert support, and its small business service is funded by the Australian Government ^[4]. Its website lists a helpline for individuals on 1800 595 160 and one for small businesses and organisations on 1800 595 170 ^[4].

Use it when: personal information may have been misused, for example staff or customer identity details, or you need help planning how to support people affected by a breach.

Your web host

Hosts see the server side of an incident that you cannot: access logs, other affected accounts, and outbound mail volume. Many will help contain a hacked site, restore a server-level backup, or take a snapshot for evidence. Tell them early, and ask them to keep logs from the period of the incident.

Banks, payment providers and email

If payment details may have been skimmed from a checkout page, tell your payment provider straight away, because it may need to act to protect cardholders. If money was transferred because of a fake invoice or a hijacked email account, contact your bank immediately. Speed matters more than anything else in getting funds stopped.

If your email account was involved, change its password from a clean device and turn on multi-factor authentication, as the Australian Cyber Security Centre recommends for your most important accounts ^[3].

The OAIC

If your organisation is covered by the Privacy Act and personal information was involved, you may need to assess whether the incident is an eligible data breach and, if so, notify affected individuals and the OAIC ^[6]. The OAIC's quick reference guide describes the contain, assess, notify and review steps ^[6]. Our data breach guide explains who is covered.

What to have ready when you call or report

Whichever service you contact, the conversation goes faster if you have a few facts to hand:

• your business name, ABN and the website address;
• when the problem was first noticed, and by whom;
• what you have seen, with screenshots if you have them;
• which accounts may be affected, such as email, hosting or payment services;
• any messages from the attacker, kept unaltered;
• what you have already done, such as changing passwords or taking the site offline.

Our incident checklist builds most of this into one text file. Leave passwords out of it, and out of any report form.

If you have cyber insurance

Some business insurance policies include cyber cover, and many set out their own steps for an incident, such as calling a specific hotline before engaging anyone or getting approval for costs. Check your policy early, ideally before paying anyone to clean the site, so that a claim is not affected. Keep invoices, reports and a timeline of what was done, because insurers usually ask for them.

Be careful of follow-up scams

After an incident becomes known, businesses sometimes receive calls or emails offering to "recover" data, remove a listing or fix the website for an upfront fee. Some come from people who saw the problem publicly; some come from the attackers themselves. Use the official contacts on this page, which you can find independently, rather than numbers or links in an unexpected message. Never give remote access to your computer, or pay, because someone contacted you first.

If you are unsure whether a message is genuine, the hotline on 1300 CYBER1 can help you check before you act.

What happens after you report

It helps to set expectations before you report. Reporting a cybercrime is mainly about recording what happened and making it visible to the people whose job is to respond at a wider scale. It is not the same as hiring someone to fix your website, and the reporting and support services on this page do not clean websites or restore backups for you.

After you submit a report or make a call, keep these points in mind:

• Save any reference number you are given, and add it to your incident notes. Your bank, insurer or host may ask for it.
• Keep working on containment and recovery in parallel. There is no need to leave the site broken or harmful while a report is being considered.
• If something new happens, such as a fresh wave of spam from your domain or a customer reporting a fake invoice, record it with the date and time. It may be worth adding to your report.
• Be wary of anyone who contacts you claiming to be following up on your report and asks for a payment or remote access to your computer. Check the contact details yourself using the official websites.

Reporting and fixing are two separate tracks, and both are worth doing. The report adds to the bigger picture and may help others. The fix is what gets your business running again, and that part is usually down to you, your host and whoever you engage to help.

Which service for which problem

For the website itself, the next step is cleanup and recovery. Our first steps guide covers what to do in the meantime.