Cyber Attack Recovery Guide for Small Businesses

60% of small businesses that suffer a major cyber attack close within six months — here's how to recover if it happens to you

A cyber attack doesn't have to end your business. The businesses that survive are the ones with a plan, tested backups, and the ability to act quickly in the first hours after discovery. According to the ACSC, the average time to detect a breach in Australia is 204 days — and the longer it takes to detect, the more expensive the recovery.

The first 24 hours — containment

Hour 0-1: Isolate and preserve

• Disconnect affected systems from the network — unplug ethernet cables, disable Wi-Fi. Do NOT power off — you'll lose volatile memory that forensic investigators need
• Change all administrative passwords — across every system, starting with email, cloud services, and domain admin
• Revoke active sessions — force logout of all users from email, cloud apps, and VPN
• Document everything — time of discovery, who discovered it, what they observed, what actions were taken. This timeline is critical for forensics and insurance claims

Hour 1-4: Assess scope

• Determine what was affected — which systems, which data, which users
• Check backup integrity — verify your most recent backup is clean and complete before attempting restoration
• Identify the attack vector — how did the attacker get in? This must be closed before recovery begins, or the attacker will return
• Engage your incident response team — internal or external cyber security professionals who can perform forensic analysis

Hour 4-24: Notify and communicate

• Notify your cyber insurance provider — most policies require notification within 24-72 hours. Late notification can void your coverage
• Report to ACSC — cyber.gov.au/report
• Assess NDB obligations — if personal information was likely accessed, you have 30 days to notify the OAIC and affected individuals under the Notifiable Data Breaches scheme
• Communicate with staff — inform employees about the incident, what systems are affected, and what they should and shouldn't do

Days 2-7 — Recovery

Eradicate the threat

• Remove all malware, backdoors, and unauthorised access
• Patch the vulnerability or close the access path the attacker used
• Scan all systems for indicators of compromise (IOCs)
• Verify the attacker no longer has access before restoring anything

Restore from clean backups

• Restore data from the most recent backup that predates the compromise
• Verify restored data integrity before bringing systems back online
• Rebuild compromised systems from scratch rather than trying to clean them — you can never be 100% certain malware has been fully removed

Resume operations gradually

• Bring systems back online one at a time, monitoring for signs of reinfection
• Implement enhanced monitoring for the first 30 days post-recovery
• Reset all user passwords with enforced strong password requirements
• Enable MFA on all accounts if not already in place

Weeks 2-4 — Post-incident

Conduct a post-incident review

• Root cause analysis — why did the attack succeed? What control failed or was missing?
• Timeline reconstruction — when did the attacker gain access, what did they do, when was it detected?
• Gap assessment — what security controls would have prevented or detected the attack earlier?
• Blameless postmortem — focus on systems and processes, not individuals

Implement improvements

Based on your post-incident review, implement the security controls that would have prevented the attack. Common post-incident improvements include:

• MFA deployment (if not already in place)
• Endpoint detection and response (EDR)
• Email security gateway improvements
• Network segmentation
• Staff security awareness training
• Regular vulnerability scanning schedule

Cost of recovery

Typical recovery costs for an Australian SMB cyber incident:

• Forensic investigation — $5,000-$30,000
• System rebuild and restoration — $10,000-$50,000
• Legal and regulatory compliance — $5,000-$20,000
• Business interruption — varies widely, but average 21 days of reduced operations
• Customer notification — $2-$5 per affected individual
• Reputational damage — the hardest cost to quantify and the longest lasting

Total typical cost for an SMB: $46,000-$150,000 — often exceeding the cost of implementing preventative security controls by a factor of 10x or more.

Building resilience before an attack

Prevention is always cheaper than recovery. The three most impactful preparedness measures:

1. Test your backups — not just that they run, but that you can actually restore from them. Quarterly restoration testing takes 2 hours and could save your business
2. Document your incident response plan — who to call, what to do, in what order. Under the stress of an active incident, you will not think clearly without a written plan
3. Get a security assessment — a VAPT identifies the vulnerabilities an attacker would exploit. Finding them first costs a fraction of dealing with the aftermath