Ransomware has shut down hospitals, ports and major companies, and exposed the private details of millions of Australians. Here’s how these attacks work, who’s behind them, and what’s being done.
Ransomware is a type of malicious software that locks up a victim’s computer systems, usually by encrypting their files so they can’t be opened. The attackers then demand a ransom, often in cryptocurrency, in exchange for a key to unlock them.
How attacks happen
Attackers usually get in through a weak point, such as a stolen password, a phishing email that tricks an employee into clicking a link, or an unpatched security flaw in software.
Once inside, they often spend days or weeks exploring the network, gaining access to more systems and copying sensitive data, before launching the attack.
Double extortion
Modern ransomware gangs rarely just lock files. They also steal large amounts of data first, then threaten to publish it online unless the victim pays. Even organisations that can restore their systems from back-ups face pressure to pay to stop the data leaking.
Many gangs operate as businesses, renting out their tools to other criminals in exchange for a share of the ransom, a model known as ransomware-as-a-service. Many are believed to be based in Russia and other countries where they’re unlikely to face arrest.
Australian attacks
In 2022, health insurer Medibank was hit by a cyber attack in which the personal and health information of about 9.7 million current and former customers was stolen. Medibank refused to pay, and the criminals published sensitive data online. In 2024, Australia used new cyber sanctions against a Russian man it identified as responsible.
Other major Australian incidents have included attacks on port operator DP World, which disrupted shipping in 2023, and law firm HWL Ebsworth, which held data from many government agencies.
Should victims pay?
The Australian Government strongly discourages paying ransoms. Paying funds criminal gangs, encourages more attacks, and doesn’t guarantee that stolen data will be deleted or files restored.
But paying isn’t illegal in most cases, and some organisations pay to get their operations running again.
Under the Cyber Security Act 2024, businesses with annual turnover above $3 million must report any ransom payment to the Australian Signals Directorate within 72 hours. The reports are designed to help authorities understand and fight ransomware, rather than penalise victims.
Protecting against it
Experts recommend multi-factor authentication, prompt software updates, regular back-ups stored separately from the main network, and training staff to spot phishing emails.
The Australian Signals Directorate’s Australian Cyber Security Centre publishes advice for businesses and households, and runs a hotline, 1300 CYBER1, for anyone hit by a cyber attack.
