A ransomware attack usually unfolds in five stages: the attacker gets in, quietly steals passwords, copies your data out, then encrypts your files and demands a ransom. Stage five is recovery, and how it goes depends on what you prepared beforehand.
Ransomware is the disaster scenario most Melbourne businesses fear, and rightly so. Small firms are not spared, despite the myth that they are too small to be a target. But it is not magic — it follows a predictable pattern, and at almost every stage, good preparation changes the outcome. Here is how an attack typically unfolds, stage by stage, and where Key IT puts a defence at each one.
Stage 1: How does ransomware get in?
Most ransomware starts with something mundane — a phished password, a malicious email attachment, or an unpatched system exposed to the internet, such as a firewall VPN. The attacker rarely "breaks in" dramatically; they walk through a door that was left open. Defence: MFA, email security, patching and staff training — the controls at the heart of the Essential Eight — close most of these doors. A free dark web scan shows whether staff email addresses already appear in known breaches.
Stage 2: What happens once they are inside?
Once inside, attackers often wait. They explore the network, steal credentials, escalate their access, and identify your most valuable data and your backups. This quiet phase can last days or weeks, although in some recent firewall VPN attacks the gap from first login to locked files was roughly an hour. Traditional antivirus usually sees nothing, because the attacker is using real accounts. Defence: this is exactly what a Security Operations Centre exists to catch — the unusual behaviour during this quiet phase, before encryption begins.
Stage 3: Why do attackers steal your data first?
Modern ransomware crews copy your data out before encrypting it, so they can threaten to publish it even if you have backups. This "double extortion" is now standard. Defence: monitoring for large data transfers, and controls that limit how much an attacker can reach.
Stage 4: What happens when your files are encrypted?
Finally, the attacker triggers encryption — often overnight or over a weekend — locking your files and leaving a ransom demand. The note usually names a price, a deadline and a threat to leak what was stolen. This is the moment you notice, and by then the earlier stages have already played out. Defence: immutable backups that the attacker could not delete mean you can recover without paying.
Stage 5: How do businesses recover from ransomware?
Ransomware recovery means containing the attack, making sure the attacker is locked out, then restoring systems and data from copies they could not reach — and preparation decides how fast that happens. A business with tested, immutable backups and an incident response plan contains the attack, restores from clean backups, and is running again — without paying a ransom. A business without them faces an impossible choice between paying criminals (with no guarantee) and losing their data, while every day offline adds to what a cyber attack costs a small business. The attack is the same; the preparation is what differs.
What should you do if ransomware hits your business?
If ransomware hits your business, isolate the affected computers, keep the evidence and get expert help fast. In the first hour:
Disconnect, but don't switch off or wipe
Unplug network cables and turn off Wi-Fi on affected machines, but leave them running — they hold the evidence.
Record what you see
Photograph the ransom note and list which systems are affected.
Don't reply or pay
Don't contact the attackers until you have advice.
Call for help
Ring your IT provider or an incident response team; Key IT (1300 053 948) helps first-time callers as well as existing clients. If you hold cyber insurance, tell your insurer early.
Report it
Lodge a report with the Australian Cyber Security Centre through ReportCyber.
How do you make sure you survive a ransomware attack?
Survival is built before the attack, not during it: layered prevention through managed cybersecurity to reduce the chance of getting in, 24/7 monitoring to catch the quiet phase, immutable and tested backups via disaster recovery, and an incident response plan ready to go. Each stage above has a defence — together they turn a business-ending event into a bad few days.
Frequently asked questions
How does a ransomware attack start?
Usually with a phished password, a malicious attachment, or an unpatched internet-facing system — an open door rather than a dramatic break-in.
Should we pay the ransom?
The goal is never to have to. With immutable, tested backups you can recover without paying. Paying funds criminals and offers no guarantee of getting your data back.
How can a SOC help against ransomware?
By detecting the quiet phase — credential theft and lateral movement — before encryption begins, allowing containment before real damage is done.
What is the most important ransomware protection?
There is no single one — layered prevention, monitoring and immutable tested backups together are what let you survive without paying.
How long does it take to recover from ransomware?
It depends on preparation. With immutable, tested backups and a response plan ready, a business can often be back on its core systems within days. Without them, recovery can drag on for weeks, and some data may never come back.
Can antivirus stop ransomware?
Not on its own. Antivirus looks for known bad files, while ransomware crews use stolen logins and normal admin tools that look legitimate. Endpoint detection and response (EDR) backed by 24/7 SOC monitoring watches for suspicious behaviour instead, catching the quiet phase before encryption.
Do we have to report a ransomware attack in Australia?
Often, yes. If you are covered by the Privacy Act and a breach of personal information is likely to cause serious harm, you must notify the people affected and the OAIC. Businesses turning over more than $3 million that pay a ransom must also report it within 72 hours — see the 72-hour ransomware payment reporting rule.
How exposed is your business? A free cybersecurity health check gives you an Essential Eight snapshot and your top three risks.
Request the Free Check