Cyber incident response Melbourne — under attack? Call 1300 053 948
Cyber incident response for Melbourne businesses hit by ransomware, hacked email or a data breach. Client or not, call Key IT on 1300 053 948 to contain it.
If the worst happens, here's exactly what we do
A calm, practised method — not a scramble, with 24/7 SOC monitoring watching for the first signs of an attack.
Detect
The 24/7 SOC flags the threat as it starts.
Contain
We isolate the affected accounts and devices to stop it spreading.
Investigate
We find the root cause and exactly what was accessed.
Recover
Clean systems restored from tested, immutable backups.
Under attack? Call 1300 053 948 for cyber incident response
Key IT provides cyber incident response for Melbourne businesses: we contain ransomware, hacked mailboxes and other active attacks, find out how the attacker got in and what they touched, recover your systems and data, and guide you through the data breach reporting that follows. We help whether or not you are already a client, and every minute counts: the sooner an attack is contained, the less it can reach.
Suspected breach right now? Call 1300 053 948 and ask for incident response. Our helpdesk answers Monday to Friday, 8am–5pm, and on-call engineers cover managed clients after hours. Not a client and it's after hours? Ring ASD's Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), 24/7.
What counts as a cyber incident?
A cyber incident is anything that suggests an attacker has got into your systems, accounts or data, or is trying to. If any of these sound familiar, treat it as an incident and call us:
Ransomware
Files encrypted, systems locked, a ransom demand. See what happens during a ransomware attack, stage by stage.
Business email compromise
A hijacked mailbox used for fraud or to redirect payments.
Microsoft 365 account compromise
Unexpected logins, new forwarding rules, rogue MFA devices. Our checklist for a hacked Microsoft 365 account sets out the first-hour steps, from blocking sign-in to removing the attacker's inbox rules.
Data exfiltration
Sensitive data being copied or sent out.
Unexplained activity
New admin accounts, disabled security tools, strange network traffic.
What happens in the first hour of incident response?
In the first hour, Key IT's focus is containment: isolating affected devices and accounts so the attack cannot spread, then working out what is happening and protecting what is not yet affected. We also preserve logs and evidence, so the investigation can establish what was accessed. How quickly it is contained has a big say in what a cyber attack ends up costing in downtime, recovery work and reporting.
Our six-step process
Detect
Confirm and scope the incident.
Contain
Isolate affected systems and accounts.
Investigate
Determine how they got in and what they touched.
Eradicate
Remove the attacker's access and tools.
Recover
Restore systems and data from clean, immutable backups.
Report
Root-cause analysis, a remediation roadmap, and regulatory reporting support.
Want to see what this looks like for your business? A free IT & Cyber Security Review shows where you stand and what to fix first — no jargon, no obligation.
Book a Free ReviewDo you have to report a data breach in Australia?
Often, yes. The Notifiable Data Breaches scheme applies to organisations covered by the Privacy Act, generally businesses turning over more than $3 million plus private health service providers of any size. You have up to 30 days to take reasonable steps to assess a suspected breach. If it is likely to cause serious harm, you must notify the OAIC and the people affected. That may tighten. The exposure draft Bill at the centre of the Privacy Act reforms 2026 would require a statement to the Information Commissioner within 72 hours of becoming aware of reasonable grounds to believe an eligible breach occurred. It is not law yet.
Some sectors have extra rules from ASIC or APRA. And if a business turning over more than $3 million pays a ransom, it must report the payment to the Australian Signals Directorate (ASD) within 72 hours. As part of our data breach response, we help you work out what must be reported, to whom and by when, and support you through it, so the legal aftermath is handled as carefully as the technical one.
Do I need an incident response retainer?
No. Key IT provides emergency cyber support to existing clients and first-time callers alike. A retainer agrees terms in advance, so you are not negotiating during a crisis. Recovery depends on backups — see disaster recovery and business continuity.
Frequently asked questions
What should I do first if I think I have been breached?
Do not turn affected machines off (it can destroy evidence), disconnect them from the network if you can, and call us immediately on 1300 053 948. Fast containment limits the damage.
Do you help businesses that are not existing clients?
Yes. We respond to incidents for new callers as well as existing clients. A retainer sets terms in advance, but we will help in an emergency regardless.
How fast can you respond?
Between 8am and 5pm on weekdays, a live security incident goes to the front of our queue, and the first job is always containment: cutting off the affected accounts and devices before anything else.
Is your incident response available 24/7?
For managed clients, after hours are covered two ways: Key IT's 24/7 SOC service watches for attacks around the clock, and a rotating roster of on-call engineers picks up urgent incidents. If you are not yet a client, call 1300 053 948; our helpdesk is open weekdays, 8am to 5pm.
Will I have to pay a ransom?
Our goal is to recover you from clean, immutable backups so you never have to. Paying is a last resort with no guarantee you get your data back, and if your business turns over more than $3 million, paying also triggers a legal duty to report it within 72 hours.
Should I contact my cyber insurer?
Yes, if you have cyber cover, tell your insurer early. Policies usually require prompt notice, and some have an incident hotline or a panel of approved responders, so check your policy wording. We can give your insurer and lawyers the technical facts they ask for: what happened, when, and what was accessed.
Who do I report a cyber incident to?
It depends on what happened, and more than one may apply. If money has moved or bank details were changed, call your bank's fraud team first. Report the cybercrime through ReportCyber at cyber.gov.au, or for a live incident ring the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371). If personal information was accessed, serious harm is likely and you can't prevent it, a business covered by the Notifiable Data Breaches scheme must notify the OAIC and the people affected. A business turning over more than $3 million that pays a ransom must report the payment to ASD within 72 hours. Businesses with 19 or fewer employees can also get free recovery help from IDCARE's Small Business Cyber Resilience Service. Treat this as a starting point, not legal advice, and confirm your duties with your lawyer.
Do you handle the legal and reporting side?
We support you through Notifiable Data Breach obligations and sector reporting, coordinating with your legal advisers as needed.
How do I prevent the next incident?
After recovery we provide a root-cause analysis and a remediation roadmap, and our managed cybersecurity and SOC monitoring sharply reduce the chance of a repeat. A free dark web scan is a quick first check on whether staff email addresses have turned up in known breaches.
Suspected breach? Act now
Call 1300 053 948 and ask for incident response. The faster we contain it, the less it costs you.
Related services & guides
Also useful
150+ Melbourne organisations, looked after every day
From manufacturing and healthcare to finance, body corporate and professional services — a few of the businesses whose IT and security we run every day.
Elite Body Corporate
Probus GroupBook your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.