Quick summary
Ransomware is malware that locks your files or devices and demands payment, often while threatening to leak data it has stolen. ASD's Annual Cyber Threat Report 2024-25 says 11 per cent of the more than 1,200 incidents ASD's ACSC responded to included ransomware, and that ransomware attacks increased in frequency during the year. The defences that work are not exotic: multi-factor authentication, fast patching, restricted admin rights, application control and backups you have actually restored from. This guide explains how ransomware gets in, which Essential Eight controls stop it and a 90-day plan for a small or mid-sized business.
On this page
- What ASD's latest figures say
- What an attack really costs
- How ransomware gets in
- Essential Eight protections against ransomware
- The backup safety net
- Detection and response
- Your 90-day ransomware defence plan
What ASD's latest figures say
The Australian Signals Directorate (ASD) publishes an Annual Cyber Threat Report each year. The 2024-25 edition, published on 14 October 2025, includes these figures for the 2024-25 financial year:
| Measure (FY2024-25) | Figure |
|---|---|
| Cyber security incidents ASD's ACSC responded to | Over 1,200, up 11% |
| Incidents responded to that included ransomware | 11%, consistent with the previous year |
| Cybercrime reports to ReportCyber | Over 84,700, down 3% (about one every 6 minutes) |
| Calls to the Australian Cyber Security Hotline | Over 42,500, up 16% |
| Average self-reported cost of cybercrime per report, small business | $56,600, up 14% |
| Average self-reported cost of cybercrime per report, medium business | $97,200, up 55% |
| Average self-reported cost of cybercrime per report, large business | $202,700, up 219% |
Source: ASD Annual Cyber Threat Report 2024-25.
Two points from the report matter for ransomware in particular. First, ASD says the frequency of ransomware attacks and the number of reported data breaches both increased during 2024-25. Second, ASD notes that the vast majority of cybercrime still goes unreported, so these numbers are a floor, not a ceiling.
The report also describes criminals stealing data and threatening to release it if their demands are not met. That means backups alone no longer solve the problem: you can restore your files and still face a data breach.
What an attack really costs
The ransom demand is only one part of the bill, and ASD's advice is not to pay it at all. The costs that land on a business regardless include:
- Downtime. Staff cannot work, orders cannot ship and invoices cannot be raised while systems are rebuilt.
- Recovery work. Forensic investigation, rebuilding servers and devices, restoring data and checking it is clean.
- Breach obligations. If personal information was accessed and the breach is likely to cause serious harm, you must notify affected people and the OAIC under the Notifiable Data Breaches scheme.
- Legal and insurance work. Advice, claims and, in some cases, disputes with customers or suppliers.
- Reputation and customers. Lost trust is hard to price and slow to rebuild.
For context, the average self-reported cost of cybercrime per report in 2024-25 was $56,600 for small businesses and $97,200 for medium businesses (ASD). Those averages cover all cybercrime types, not only ransomware, but they show the scale of losses Australian businesses are reporting.
How ransomware gets in
Ransomware rarely arrives out of nowhere. The usual ways in are:
| Entry point | How it works |
|---|---|
| Phishing emails | A staff member opens a malicious attachment or link, or types their password into a fake login page |
| Stolen or weak credentials | Usernames and passwords bought from earlier breaches or info-stealer malware are used to log in to email, VPN or remote access |
| Unpatched internet-facing systems | Known vulnerabilities in firewalls, VPNs and web applications are exploited, sometimes within days of being published |
| Exposed remote access | Remote Desktop or similar services open to the internet without MFA |
| Suppliers and service providers | An attacker compromises a provider with access to your systems and uses that access to reach you |
ASD's report describes criminals buying stolen usernames and passwords to access email and corporate networks, and names phishing, compromised accounts and gathering victim identity information as the top three techniques observed across incident reporting in 2024-25.
The typical attack sequence
- Initial access through one of the routes above.
- Exploration. The attacker maps the network, looks for admin accounts and finds the valuable data and the backups.
- Data theft. Files are copied out so the attacker can threaten to publish them.
- Encryption. Ransomware is deployed across as many systems as possible, often outside business hours.
- Extortion. A ransom note demands payment for a decryption key and for not publishing the data.
The time between steps 1 and 4 is your chance to catch the attacker. Monitoring for unusual logins, new admin accounts and large outbound transfers is what turns a potential disaster into a contained incident.
Essential Eight protections against ransomware
The Essential Eight is ASD's set of prioritised mitigation strategies, and ASD describes it as the most effective of its strategies to mitigate cyber security incidents. Each control maps to a part of the ransomware sequence:
| Essential Eight strategy | What it does against ransomware |
|---|---|
| Application control | Stops unapproved programs, including ransomware, from running |
| Patch applications | Closes the known vulnerabilities attackers use to get in |
| Configure Microsoft Office macro settings | Blocks malware delivered through Office documents |
| User application hardening | Reduces what browsers and other apps will run from the internet |
| Restrict administrative privileges | Makes it much harder to take over the whole network |
| Patch operating systems | Closes vulnerabilities in Windows, servers and network devices |
| Multi-factor authentication | Stops stolen passwords alone from being enough to log in |
| Regular backups | Lets you recover without paying, if backups are protected and tested |
Patch timeframes worth knowing
The Essential Eight maturity model sets specific timeframes. For example, patches for vulnerabilities in online services and in internet-facing servers and network devices should be applied within 48 hours of release when the vendor assesses the vulnerability as critical or a working exploit exists. If your current provider patches "monthly", that is a gap.
Choosing a target maturity level
ASD says organisations should identify a target maturity level suitable for their environment and implement each level progressively, aiming for the same level across all eight strategies before moving up. For most small and mid-sized businesses, Maturity Level One across all eight is the first goal, with Maturity Level Two the common target after that. Our Essential Eight compliance guide explains the levels.
The backup safety net
Even with good prevention, something may get through. Backups are the last line of defence, but only if the attacker cannot reach them and you know they restore.
| Requirement | What good looks like |
|---|---|
| Frequency | Backups of important data, applications and settings run in line with how critical each system is |
| Separation | At least one copy that is offline, immutable or otherwise out of reach of your normal admin accounts |
| Protection | Backup systems use separate credentials with MFA, so a compromised admin account cannot delete them |
| Restore testing | Restores are tested as part of disaster recovery exercises, as the Essential Eight requires |
| Recovery targets | You know how long a restore of each critical system takes and how much data you could lose |
A backup you have never restored from is a hope, not a plan. Test a full restore of your most important system, time it and write down what went wrong.
Detection and response
Prevention reduces the chance of an attack. Detection and response reduce the damage when one gets through.
| Layer | Basic approach | Managed detection and response |
|---|---|---|
| Prevention | Antivirus and occasional patching | Essential Eight controls, MFA everywhere, patching to ASD timeframes |
| Detection | Signature-based antivirus | Behavioural detection that looks for attacker activity before encryption |
| Response | Reactive, after the ransom note appears | Analysts and endpoint tools that can isolate affected devices quickly, following a tested playbook |
| Recovery | Restore from backup, if it works | Protected backups with regular restore tests and a documented recovery plan |
Signals worth monitoring include logins from unusual places or at unusual times, new admin accounts, new remote access tools, mass file changes and unusual outbound data transfers.
Your 90-day ransomware defence plan
Days 1-30: quick wins
| Action | Why |
|---|---|
| Enable MFA on email, remote access, cloud services and all admin accounts | Stolen passwords are one of the most common ways in |
| Test a restore of your most critical system | Confirms you can recover without paying |
| Set up automated patching and check internet-facing systems first | Closes the vulnerabilities attackers scan for |
| Block Office macros from the internet | Removes a common malware delivery method |
| Give admins separate admin accounts and remove local admin from staff | Limits how far an attacker can get |
Days 31-60: stronger defences
| Action | Why |
|---|---|
| Deploy application control | Stops unapproved programs from running |
| Put monitoring in place for endpoints and Microsoft 365 | Catches attackers during the exploration stage |
| Run phishing awareness training | Helps staff spot and report suspicious messages |
| Harden browsers and email clients | Reduces web-based attacks |
| Separate backup credentials and add an immutable or offline copy | Stops ransomware deleting your backups |
Days 61-90: make it stick
| Action | Why |
|---|---|
| Assess against Essential Eight Maturity Level One | Shows where you stand and what is left |
| Run a tabletop exercise of your incident response plan | Your team knows who does what, and who to call |
| Segment the network | Limits how far ransomware can spread |
| Schedule regular restore tests | Keeps recovery capability proven, not assumed |
By day 90 you should have MFA everywhere, tested backups, patching on a schedule you can prove, monitoring in place, a rehearsed incident response plan and a clear picture of your Essential Eight maturity.
Ready to protect your business?
The two actions that matter most are MFA on every system and a restore test you have actually run. From there, work through the 90-day plan above. If you want help assessing your exposure and putting monitoring and tested backups in place, see our managed cybersecurity service, or, if you want security handled as part of day-to-day IT, our managed IT services.