Cyberattack response for companies in Australia
Evidence, reports, counsel, insurance and public communications after a cyberattack in Australia.
এই ভাষায় নিবন্ধের মূল অংশ নেই; ইংরেজি দেখানো হচ্ছে।
Use this checklist when a company operating in Australia suspects an attack. Choose the jurisdiction from the legal entity, affected information and operations; the reading language does not determine which law applies. Sources checked on 20 October 2026. This is a Mithril editorial workflow, not an official filing form. Confirm applicable duties with qualified counsel.
## 1. Establish the response team and preserve facts
Name an incident commander, technical lead, legal reviewer, communications owner and finance contact. Choose a trusted contact channel if the corporate account or email system may be compromised. Authorize the technical scope before collection or changes. Preserve supplied originals, acquisition times, time zones and hashes; keep summaries and translations as separate versions.
Prepare a minimum factual packet: discovery and awareness times, affected services, confirmed impact, suspected impact, evidence references, open questions and current owners. Unknown leakage or an uncertain person count stays unknown. Run technical response, counsel, reporting, communications and insurance in parallel; an unfinished investigation must not silently consume another task’s deadline.
## 2. Check local reporting routes and deadlines
For entities covered by the NDB scheme, assess suspected eligible breaches promptly and take reasonable steps to finish the assessment within 30 calendar days. An eligible breach can require OAIC and individual notification as soon as practicable. Thirty days is not a general permission to delay notice. [OAIC — Notifiable Data Breaches scheme](https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-4-notifiable-data-breach-ndb-scheme)
Use cyber.gov.au to select the appropriate cybercrime or cyber-incident reporting route. The government’s reporting directory links separate agency requirements; it is not one universal submission form. [Australian Signals Directorate — Report a cyber security incident](https://www.cyber.gov.au/report-a-cyber-security-incident)
Check additional duties for critical infrastructure, telecommunications and any applicable ransomware-payment reporting. Notification, expenditure approval and an insurance claim remain separate decisions. [Australian Government — Single Reporting Portal](https://www.cyber.gov.au/single-reporting-portal)
## 3. Brief counsel and review insurance early
Give counsel a restricted brief with the factual timeline, source inventory, known gaps and jurisdiction questions. Verify professional identity, conflicts, engagement scope and fees. Ask the policyholder’s insurer or broker about notice timing, panel providers and any preapproval before commissioning work. Separate notification from a later claim, coverage decision or payment. Record evidenced costs and uncertain losses without promising reimbursement.
## 4. Prepare public communications and direct notices
Prepare one approved factual version for each audience. A public statement should cover confirmed service impact, actions being taken, what remains under investigation, protective steps, a verified contact route and the next update. Do not invent attribution, promise a recovery date or describe unobserved exfiltration as “no data lost”. A press release does not automatically replace direct notices required by law or contract.
Draft structure: “We identified [confirmed event] on [time and zone]. [Confirmed impact]. We are taking [approved actions]. We are investigating [unknowns]. Affected people can [reviewed protective steps]. Contact [verified route]. The next update is planned for [approved time].” Replace every placeholder, review the exact version and record approval before publication.
## 5. Use the Agent preparation plan
The proposed Mithril Agent/Registry integration defines 12 preparation and tracking capabilities: evidence inventory, source-linked timeline, next actions, obligation review, recipient-specific drafts, counsel briefs, communications, loss schedules and receipt reconciliation. This enterprise workflow is planned. Publishing this guide does not make it an available executor or an official reporting connector. Authorized people submit and publish through the appropriate channels; any future delegated connector needs separate qualification.
## 6. Download the country process
The BPMN 2.0 file is an authored, non-executable reference with five concurrent workstreams, human decisions, review escalation and accepted handoffs. It includes this country’s source context, not an official authority process. The current Mithril execution subset does not implement every element in this model.
- [Download BPMN for Australia (English)](https://blog.mithril.fund/processes/enterprise-cyber-response/v0.1.0/au/en.bpmn)
- [Read the planned capability contract](https://blog.mithril.fund/processes/enterprise-cyber-response/v0.1.0/capabilities.json)
- [View artifact hashes and versions](https://blog.mithril.fund/processes/enterprise-cyber-response/v0.1.0/manifest.json)
## 7. Keep an action and receipt ledger
For each action, record the recipient and purpose, accountable owner, source and trigger for a candidate deadline, confirmed review time, approved payload/version, dispatch record, official receipt and next step. Submission, receipt, acceptance, coverage and recovery are different outcomes. Reconcile an unknown result before retrying. Close operational response only after recovery approval and accepted ownership of continuing legal, regulatory and insurer work.
## Official sources for this country
- [OAIC — Notifiable Data Breaches scheme](https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-4-notifiable-data-breach-ndb-scheme)
- [Australian Signals Directorate — Report a cyber security incident](https://www.cyber.gov.au/report-a-cyber-security-incident)
- [Australian Government — Single Reporting Portal](https://www.cyber.gov.au/single-reporting-portal)
[Compare the other country guides](https://blog.mithril.fund/cyber-incident-response-by-country?lang=en)