Assignment – Incident Response Plan for a Ransomware Attack on an Australian SME

Introduction

Ransomware is currently the most disruptive cyber threat facing Australian small and medium enterprises (SMEs). The Australian Signals Directorate received a cybercrime report approximately every six minutes during 2023-24, and self-reported losses for small businesses averaged A$49,600 per incident (Australian Signals Directorate [ASD], 2024). Logistics operators are particularly exposed because revenue depends on continuous system availability, and even short outages cascade into missed delivery windows, contractual penalties and customer attrition (Richardson & North, 2017). This assignment develops and justifies an incident response plan for a simulated ransomware attack on a 40-staff Melbourne logistics SME. The plan is structured around the incident response life cycle described in NIST Special Publication 800-61 (National Institute of Standards and Technology [NIST], 2025) and adapted to Australian obligations, including the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth), reporting expectations set by the Australian Cyber Security Centre (ACSC), and cyber insurance conditions. The analysis moves from a critical asset assessment through each response phase, quantifies recovery objectives and downtime costs, and closes with an Essential Eight uplift roadmap.

Scenario and Critical Asset Assessment

Yarraview Logistics Pty Ltd is a fictional third-party logistics provider operating a single warehouse in Laverton North, in Melbourne’s western industrial corridor. The company employs 40 staff, turns over approximately A$9.6 million annually, and provides warehousing, order fulfilment and metropolitan delivery for grocery and retail customers across Victoria. Its technology environment is typical of an Australian SME: an on-premises warehouse management system (WMS), a dispatch and route-planning application, a Windows file server, electronic data interchange (EDI) links with two national retail customers, Microsoft 365 for email, and a cloud accounting platform. Information technology support is outsourced to a managed service provider (MSP).

At 3:10 am on a Tuesday, an attacker logged in to the company’s virtual private network (VPN) using credentials harvested through an earlier phishing email. The VPN was not protected by multi-factor authentication (MFA). After escalating privileges through an unpatched Windows server, the attacker deleted the network-attached backup repository, deployed ransomware across the server environment, and encrypted the WMS database, the dispatch system and the file server. The ransom note demanded A$180,000 in cryptocurrency and claimed that 60 GB of data had been exfiltrated, including employee records containing tax file numbers and customer rate cards. This double-extortion pattern, combining encryption with a threat to publish stolen data, is now standard criminal practice (Connolly & Wall, 2019; Sophos, 2024). Table 1 assesses the affected assets and the outage each function can tolerate.

Table 1: Critical asset and business impact assessment

Incident Response Plan

The plan follows the NIST life cycle of preparation; detection and analysis; containment, eradication and recovery; and post-incident activity (NIST, 2025). For operational clarity these are expanded into the six stages shown in Figure 1, an approach consistent with ACSC ransomware guidance for Australian organisations (Australian Cyber Security Centre [ACSC], 2023). The stages are sequential in presentation but iterative in practice, and lessons learnt feed back into preparation.

Preparation

Response quality is largely determined before an incident occurs, and organisations that rehearse their plans respond measurably faster than those that merely document them (Ahmad et al., 2015). The preparation stage of this plan establishes a written incident response policy with defined roles: the managing director holds decision authority, the operations manager acts as incident manager, the MSP provides the technical lead, and the insurer’s panel forensic firm supplies specialist capability. A printed contact tree lists after-hours numbers for the MSP, the insurer’s hotline and key customers, because digital contact lists may themselves be encrypted. Preparation also mandates the backup architecture that ultimately saved the company: nightly full backups with four-hourly transaction log backups, replicated to immutable cloud storage under a seven-day retention lock that the attacker could not delete. A tabletop exercise is run annually, and a cyber insurance policy with a A$2 million limit is maintained. The scenario nevertheless exposed preparation failures, most notably the absence of MFA and delayed patching, which are addressed in the uplift section.

Detection and Analysis

Detection unfolded through operational rather than security channels, which is common in SMEs without around-the-clock monitoring. At 3:55 am the night-shift supervisor could not log pallet scans; at 4:10 am the backup platform emailed a job failure alert; by 5:05 am the MSP had found the ransom note on the WMS host; and at 5:30 am the incident was declared critical and a decision log opened. Analysis then established scope and entry point. VPN authentication logs identified the compromised account and the login source, and the absence of MFA confirmed the initial access path. One encrypted host was forensically imaged before any remediation, and firewall and VPN logs were exported to clean storage, because evidence quality determines both the insurer’s coverage position and the data breach assessment required by the Office of the Australian Information Commissioner (OAIC, 2024). Critically, the exfiltration claim was treated as true until forensics could establish otherwise, and no machine was wiped or rebooted before triage.

Containment

Immediate tactical containment disabled the VPN, isolated the server VLAN at the core switch, blocked outbound traffic from the affected subnet, disabled the compromised account, and forced tenant-wide password resets and session revocation across Microsoft 365. The strategic containment decision then required balancing downtime against further data loss. Table 2 compares the four options considered.

Table 2: Containment decision matrix

Option B was selected because Table 1 shows the cloud services were unaffected and were needed to keep customers informed, while the on-premises segment had to be assumed hostile. Payment was rejected on four grounds: the ACSC advises against payment because it funds further crime and offers no guarantee (ACSC, 2023); organisations that pay typically incur roughly double the total recovery cost of those that restore from backups (Sophos, 2024); payment would create sanctions and reporting exposure; and, as the next section quantifies, the forecast cost of recovery was approximately half the demand.

Eradication

Eradication removed the adversary rather than merely the malware. The forensic provider confirmed the initial access path, identified persistence mechanisms including a rogue administrator account and two scheduled tasks, and verified the attacker’s dwell time from log evidence. Consistent with ACSC (2023) guidance, affected servers were rebuilt from known-good installation media rather than disinfected, all credentials were reset including service accounts and local administrator passwords, the VPN concentrator and server fleet were patched, and endpoint detection and response tooling was deployed across every host before any restoration began. Backup restore points were mounted and scanned inside an isolated recovery VLAN to confirm they predated the compromise, preventing reinfection from tainted backups.

Recovery and Downtime Cost Analysis

Recovery sequencing followed the business priorities in Table 1, and its urgency was quantified through a simple downtime cost model. The daily cost of outage comprises lost contribution margin, idle direct labour and contractual service credits:

• Daily revenue = annual revenue ÷ operating days = 9,600,000 ÷ 250 = A$38,400
• Lost contribution = daily revenue × contribution margin = 38,400 × 0.32 = A$12,288
• Idle direct labour = 25 operational staff × 7.6 hours × A$38.50 = A$7,315
• Contractual service credits to retail customers = A$4,200 per day
• Total daily downtime cost = 12,288 + 7,315 + 4,200 = A$23,803

A worst-case four-day outage therefore costs approximately 4 × 23,803 = A$95,212 before professional fees, which is well below the A$180,000 demand and confirms the financial logic of refusing payment. The recovery time objectives (RTOs) and recovery point objectives (RPOs) in Table 3 were set so that each system returns within its maximum acceptable outage from Table 1.

Table 3: Recovery objectives and restoration approach

In the simulated response, email returned within 6 hours, the WMS within 22 hours and dispatch within 34 hours, all inside their objectives. Actual downtime of roughly 2.5 operating days cost approximately 2.5 × 23,803 = A$59,508, and adding A$28,000 in forensic and rebuild fees brought the total to about A$87,500, less than half the ransom demand.

Notification and Reporting Obligations

Because its annual turnover exceeds A$3 million, the company is an APP entity bound by the Privacy Act 1988 (Cth) and cannot rely on the small business exemption. The exfiltration of employee records containing tax file numbers creates a likely risk of serious harm, so the incident is an eligible data breach under the NDB scheme. The company must complete its assessment within 30 days, although the OAIC expects far faster action where harm is evident, and must then notify the OAIC and affected individuals as soon as practicable, describing the breach, the kinds of information involved and recommended protective steps (OAIC, 2024). Affected staff were advised to alert the Australian Taxation Office to potential tax file number misuse and to enable credit monitoring.

Three further notifications apply. First, the incident was reported through ReportCyber, the national cybercrime reporting service operated by the ASD, which generates a reference number that insurers typically require and feeds national threat intelligence (ASD, 2024). Second, the cyber insurer was notified within its 48-hour policy window, engaged its panel forensic provider, and provided written consent requirements covering any public statement or payment decision. Third, both retail EDI customers received contractual security-incident notices within 72 hours. Finally, had a ransom been paid, the Cyber Security Act 2024 (Cth) would have required a ransomware payment report to the Australian Government within 72 hours, an obligation that applies to businesses with turnover above A$3 million; the 2023-2030 Australian Cyber Security Strategy makes clear that government policy strongly discourages payment (Department of Home Affairs, 2023). Documenting these obligations inside the plan prevents them being discovered mid-crisis.

Lessons Learnt and Essential Eight Uplift

A blameless post-incident review was held within two weeks, attended by the directors, the MSP and the forensic provider. Research on Australian organisations shows that firms frequently treat incidents as isolated events and fail to convert them into systematic learning, so the review was structured around root causes rather than blame (Ahmad et al., 2015). Five root causes emerged: single-factor VPN authentication, an unpatched internet-facing server, backups reachable over the standard network, excessive administrative privileges, and no after-hours security monitoring.

These map directly onto the ASD Essential Eight, and the review set a target of Maturity Level One across all eight strategies within six months (ASD, 2023). The uplift actions were prioritised as follows:

1. Enforce phishing-resistant MFA on the VPN, Microsoft 365 and all remote administration, removing the initial access path.
2. Harden the backup regime: retain the immutable cloud tier, separate backup credentials from domain accounts, and run quarterly test restores with timed results reported to the board.
3. Patch operating systems and applications within 48 hours for internet-facing services and within two weeks elsewhere.
4. Restrict administrative privileges through separate admin accounts, removal of local administrator rights and quarterly privilege reviews.
5. Deploy application control on servers, restrict Microsoft Office macros and harden user applications in line with Essential Eight baselines.

The indicative first-year cost of A$60,000-A$75,000 is less than three days of downtime at the calculated daily rate of A$23,803, which reframes the uplift as availability insurance rather than discretionary spending. The review also scheduled annual tabletop exercises simulating double extortion, and quarterly phishing simulations with targeted training for staff who click.

Conclusion

This plan demonstrates that a structured, NIST-aligned response allows even a small Australian logistics operator to survive a double-extortion ransomware attack at less than half the cost of the ransom demanded. Three findings stand out. First, preparation was decisive: the immutable offsite backup was the single control that converted a potential catastrophe into a manageable outage. Second, containment is a business decision as much as a technical one, and the decision matrix in Table 2 shows why segmented isolation dominated both full shutdown and payment. Third, Australian obligations under the NDB scheme, ReportCyber and the Cyber Security Act 2024 (Cth) must be embedded in the plan itself, not researched during a crisis. The Essential Eight uplift closes the specific gaps the attacker exploited and does so at a cost the downtime model easily justifies.

References

Ahmad, A., Maynard, S. B., & Shanks, G. (2015). A case analysis of information systems and security incident responses. International Journal of Information Management, 35(6), 717-723.

Australian Cyber Security Centre. (2023). Ransomware emergency response guide. Australian Signals Directorate.

Australian Signals Directorate. (2023). Essential Eight maturity model. Australian Government.

Australian Signals Directorate. (2024). Annual cyber threat report 2023-24. Australian Government.

Connolly, L. Y., & Wall, D. S. (2019). The rise of crypto-ransomware in a changing cybercrime landscape: Taxonomising countermeasures. Computers & Security, 87, Article 101568.

Cyber Security Act 2024 (Cth).

Department of Home Affairs. (2023). 2023-2030 Australian cyber security strategy. Australian Government.

National Institute of Standards and Technology. (2025). Incident response recommendations and considerations for cybersecurity risk management (NIST Special Publication 800-61, Revision 3). U.S. Department of Commerce.

Office of the Australian Information Commissioner. (2024). Data breach preparation and response: A guide to managing data breaches in accordance with the Privacy Act 1988 (Cth). Australian Government.

Privacy Act 1988 (Cth).

Richardson, R., & North, M. M. (2017). Ransomware: Evolution, mitigation and prevention. International Management Review, 13(1), 10-21.

Sophos. (2024). The state of ransomware 2024. Sophos.