Not every extortion attack locks up your systems. Increasingly, attackers quietly copy data and then send a demand: pay, or we publish. Your systems keep running, which can make it tempting to ignore or to pay quickly. Neither is a good first move.
This guide is for leaders and IT teams in Australia and New Zealand facing a demand like this.
Don’t reply to the attacker, don’t pay and don’t download any “proof” files they send until you’ve taken advice. Email response@authene.com.au and a responder will reply within 15 minutes, 24/7/365.
First: is it real?
Some extortion emails are bluffs. Others follow real theft. Typical signs it may be genuine:
- The attacker provides samples that match your real data
- Your organisation appears on a leak site
- There has been recent unusual activity: a compromised account, an unexplained file transfer, or a supplier breach
Even a bluff needs checking, because the message itself means someone has looked at you as a target. The key questions are whether data actually left your environment, what it was, and how it got out.
What to do in the first hours
- Don’t engage. Leave any contact with the attacker to leadership, legal counsel and your insurer.
- Keep the message and any samples exactly as received. Don’t forward them widely.
- Brief a small group: leadership, your IT provider, legal counsel and your insurer. Keep it need-to-know.
- Preserve evidence. Don’t wipe systems or delete accounts that might show how the data was taken.
- Get an investigation started. The facts drive every other decision.
What an investigation establishes
- Whether data was taken, and if so, roughly what and how much
- How the attacker got in and whether they still have access
- Whose information is involved: staff, customers, suppliers or partners
- Whether the samples match your real data, and where they came from
These answers matter for leadership, for your insurer and for your legal counsel, who will consider whether you have notification obligations under Australia’s Notifiable Data Breaches scheme or New Zealand’s Privacy Act 2020.
Should you pay?
That decision belongs to leadership, legal counsel and your insurer. It’s worth knowing that paying doesn’t guarantee stolen data is deleted, and in Australia certain businesses must report extortion payments to the Australian Signals Directorate within 72 hours. Read more in our guide to whether to pay a ransomware demand.
If data is published
If data does appear online, don’t download or share it. Record where it appeared, tell your legal counsel and insurer, and be ready for follow-up scams aimed at the people whose information was exposed. IDCARE offers free support to affected Australians and New Zealanders.
Get help
Authene responds to extortion, data leaks and incidents that don’t fit a box across Australia and New Zealand. We establish the facts quickly and report them clearly, so the people deciding can decide well.
Sources
- Australian Signals Directorate, ReportCyber
- Office of the Australian Information Commissioner, Notifiable Data Breaches
- Privacy Commissioner (NZ), Privacy breaches