Incident response · Sydney
Cyber incident response, Sydney.
When a cyber incident hits a Sydney business, the first hour matters most. Email Authene and a responder replies within 15 minutes, 24/7/365, and starts working remotely straight away.
Response
15 minutes, 24/7/365
How
Remote response, so no travel time
Time zone
AEST, and AEDT in daylight saving
Covers
Sydney and New South Wales
If it’s happening now
What to do first in Sydney
- Don’t power off affected computers. Disconnect them from the network instead
- If money may have moved, call your bank now and ask them to try to recall it
- Don’t delete emails, files or accounts. They are evidence
- Follow your insurer’s incident process if you have cyber cover
- If staff or customer identity documents may be exposed, ID Support NSW can help them
- Email response@authene.com.au. A responder replies within 15 minutes
Remote response for Sydney
Remote help across Greater Sydney
Authene responds remotely, so a Sydney business doesn’t wait for anyone to travel. The evidence in a modern incident mostly sits in Microsoft 365, cloud services and system logs, which we reach securely from anywhere.
If something needs hands on a device, we guide your IT team or provider through it, step by step.
Incidents we respond to
Incidents we handle in Sydney
You don’t need to know what kind of incident it is before you get in touch.
NSW in numbers
Where NSW stands.
Source: ASD Annual Cyber Threat Report 2025–26. National figures unless stated. Costs are averages that businesses reported themselves.
22%
of cybercrime reports to ReportCyber came from NSW in 2025–26. ASD notes NSW, Victoria and Queensland report more cybercrime than their populations alone would suggest.
$55,400
average cost per cybercrime report for a small business. For a medium business it was $141,300, up 45%.
Every 6 minutes
a cybercrime was reported somewhere in Australia, more than 82,000 reports over the year.
Industries we see in Sydney
Where Sydney’s incidents start.
Sydney is Australia’s financial and professional services centre, so many incidents here are about payments and client data.
Finance and professional services
Mailboxes are watched for weeks, then used to change a client’s or supplier’s bank details just before a payment. We find how they got in and what else they read.
Property and settlements
Large, time-critical transfers make settlements a target. If money has moved, call your bank first, then get in touch.
Technology and online services
Stolen sign-ins to Microsoft 365 and cloud platforms can expose customer data. We establish what was accessed so you know who may be affected.
How it can play out
A Sydney example: the Friday settlement
Illustrative example. Names, amounts and times are made up. For a real one, read how $96,000 in fraud was stopped in Sydney.
Fri 3:40 pm
A conveyancer’s client emails to say the bank details for Monday’s settlement have changed.
Fri 4:05 pm
The firm checks on a phone number it already holds. The client never sent the email.
Fri 4:12 pm
They email Authene. A responder replies within 15 minutes with the first steps.
Fri evening
The compromised mailbox is secured and the attacker’s access traced, before the weekend.
Mon 9 am
Settlement goes ahead on verified details, with a clear account for the firm’s insurer.
Supplying NSW government?
If you hold agency data.
Since 28 November 2023, NSW public sector agencies have had to notify the Privacy Commissioner and affected people of eligible data breaches, under the Mandatory Notification of Data Breach scheme.
The duty sits with the agency. The scheme doesn’t generally apply to contractors directly, but agency contracts usually require you to report a breach promptly and help with the assessment.
If you’re a supplier
A summary your agency client can use
A government client will want to know quickly what happened and whether its data was involved. Our early findings are written to be passed on: what we know, what we don’t know yet, and what’s being done.
If notification is being considered, we give the agency and your advisers the facts to decide on.
Time zone
On Sydney time, day or night.
We respond on Sydney time, including weekends and public holidays. Attacks are often timed for Friday nights and long weekends, when fewer people are watching.
During daylight saving, Sydney is an hour ahead of Brisbane and three hours ahead of Perth. If your business runs across states, we work to every office’s clock.
Long weekends
On through the NSW long weekends
Attackers favour long weekends, when inboxes go quiet and fewer people are watching. NSW has several, from Easter and the King’s Birthday in June to the Labour Day long weekend in October.
We respond 24/7/365, public holidays included, so a long weekend doesn’t mean a long wait.
Help and reporting in NSW
Where to report a cyber incident in NSW
These services are free. ID Support NSW is a NSW Government service; the rest are national. Your legal counsel can tell you whether you must notify anyone.
Questions
Cyber incident questions from Sydney
Who do we report a cyber incident to in NSW?
Report cybercrime through ReportCyber, run by the Australian Signals Directorate, and scams to Scamwatch. If money has moved, call your bank first. Your legal counsel can advise on any other notifications.
Is there NSW Government help if identities are exposed?
Yes. ID Support NSW helps people whose identity documents were stolen or misused, and offers free resources for small businesses. We establish what was accessed so you know who may be affected.
Can you work with our IT provider?
Yes. Many Sydney businesses outsource IT. We work alongside your managed service provider: they keep systems running while we investigate how the attacker got in and what they touched.
Sydney
Incident in Sydney? Email us now.
Email us and a responder will reply within 15 minutes, 24/7/365, on Sydney time. If you’re not sure it’s an incident yet, get in touch anyway.