Business claims

Cyber incident: what to do and what to gather

Act fast, contain it and call your insurer before you pay anyone.

Many cyber policies include an emergency response line. Call your insurer or broker first, before paying a ransom or hiring a specialist yourself.

Do this first

Contain the incident Disconnect affected devices from the network. Don't turn them off if your insurer or IT provider advises otherwise.
Call your insurer or broker straight away Many policies have a 24-hour response line and may require you to use their approved providers.
Preserve evidence Keep logs, emails and screenshots. Don't wipe systems until advised.
Report it You can report cybercrime to the Australian Government through ReportCyber. You may also have to notify affected people and the privacy regulator if personal information is involved.

Who to tell

Your insurer or broker: Call the emergency line on your policy first.
Your IT provider: To help contain the incident.
ReportCyber (Australian Government): Report the cybercrime.
Affected people and the privacy regulator: Needed if the incident exposes personal information and could cause serious harm. Check the rules for your business.
Your bank, if money or accounts are involved: They may be able to stop payments.

What to gather

What happened and when you found out. Your insurer's first questions.
Logs, emails and screenshots. Show how the incident happened.
Which systems and data were affected. Sets the scope of the response.
Costs you've had, such as specialists, downtime and notification. Needed for the claim.
Any ransom note or demand. Keep it, but don't pay without advice.

Things that catch people out

Hiring your own specialists before telling your insurer can mean those costs aren't covered.
Paying a ransom without advice can cause problems for your claim. Speak to your insurer and the authorities first.

General guidance only. It isn't your insurer's requirements or financial advice. Always check your policy documents and your insurer's instructions.