# job 05 · reporting an incident
Reporting a cyber incident on a VPS you run
ASD asks organisations to report a cyber security incident as early as possible, even if the threat is only suspected, and its hotline, 1300 CYBER1 (1300 292 371), is open 24 hours a day, 7 days a week. ASD says: “Some sectors also have mandatory reporting requirements. Information voluntarily shared with us by Australian organisations is protected by law.” A cybercrime is reported to police through ReportCyber, which ASD calls “our joint tool”, and a breach involving customers’ personal information can bring separate duties under the Privacy Act.
General information, not legal or technical advice. This guide rests on ASD’s incident and cybercrime pages on cyber.gov.au; for personal information, the official place to check is the Office of the Australian Information Commissioner (OAIC).
definitionWhat counts as an incident
ASD’s definition: “A cyber security incident is an unexpected event(s) that has compromised, or could disrupt, business operations. This could include unauthorised access to, modification of, or impairment to systems, data, programs or communications.”
ASD: “Common incidents include:”
> “Denial of Service attacks”
> “scanning and reconnaissance”
> “intentional or malicious unauthorised access to network or device”
> “data exposure, theft or leak”
> “malicious code or malware”
> “ransomware”
> “phishing and spear phishing”
> “other irregular cyber activity that causes concern.”
The timing advice is broad: “Report a potential incident as soon as possible, even if you think it may be a false alarm or it happened some time ago.” The Essential Eight maturity model makes prompt reporting a Maturity Level Two requirement: “Cyber security incidents are reported to ASD as soon as possible after they occur or are discovered.” ASD says organisations implementing it “should identify and plan for a target maturity level suitable for their environment”.
routes: 3Three reports, three places
| What happened | Where it goes | What the page says |
|---|---|---|
| A cyber security incident | ASD, by its hotline, 1300 CYBER1 (1300 292 371) | After a report, ASD says it will contact you with immediate advice and support, which may include how to contain and remediate the incident. |
| A cybercrime | Police, through ReportCyber | For a hacked device or account, ASD’s cybercrime page lists reporting to police through ReportCyber among the steps to take, alongside contacting your bank to secure any affected accounts or cards. |
| An eligible data breach of personal information | The OAIC, for businesses covered by the Privacy Act 1988 | Under the Notifiable Data Breaches scheme, individuals likely to suffer serious harm must, subject to some exceptions, be notified. |
ASD’s report page names four kinds of report: “Report a cybercrime, incident, vulnerability or ransomware payment.”
When a breach is only suspected
The Privacy Act has a step for the uncertain stage. Where an entity is aware of reasonable grounds to suspect an eligible data breach, but not yet of grounds to believe one has happened, section 26WH says it must carry out a “reasonable and expeditious assessment” and “take all reasonable steps to ensure that the assessment is completed within 30 days after the entity becomes aware”. Which businesses the Act covers is not set out here; the OAIC is the official place to check.
evidenceWhat ASD may ask a server’s operator for
This is where the other jobs pay off. ASD says it may ask for data about the incident, and lists what that may include:
- “logs”
- “memory dumps”
- “disk images”
- “network traffic captures”
- “network diagrams or documentation”
- “indicators of compromise”
- “samples of malware”
- “other analysis or reporting products.”
It may also ask about your own arrangements, so it can tailor its advice. Its list, quoted in order:
- “your cyber security incident response plan and whether it has been activated and can be shared”
- “whether you have access to technical resources to investigate and respond to the incident, such as an incident response provider”
- “actions taken so far and how they have been recorded”
- “steps taken to contain the threat and whether the threat actor still has access to your systems”
- “whether you can identify and isolate affected workstations or systems”
- “your next steps for investigating and responding to the incident.”
limited useWhat happens to what you share
“Information you voluntarily provide us about a cyber security incident or vulnerability is protected by a Limited Use obligation under law. This means information you provide to ASD can’t be used as evidence against you in civil or criminal proceedings.”
ASD says reports also help it build a national picture of cyber threats, and that it may use anonymised information from them in public alerts and threat reporting. Some sectors also have mandatory reporting requirements.
inboundWhen ASD contacts you first
The call can come the other way. ASD says it may contact you if it identifies a vulnerability or compromise, potential or confirmed, even if you haven’t reported anything, and the information it shares may include compromised credentials or signs of activity that comes before ransomware.
If you are unsure whether such a call is genuine, ASD’s advice is to end the call and contact it directly on 1300 CYBER1 (1300 292 371), quoting any incident reference number you have.