Newsmedia and security industry experts were still studying what happened when a cyber attack hit Nine Entertainment, as the Australian broadcast and media giant struggled to get back to normal.

With all the symptoms of ransomware except the ransom demand, the attack left Nine having to move broadcasts and support teams to Melbourne and an NRL commentary panel to Newcastle in order to get weekend programmes out.

It's been an initiation by fire for Mike Sneesby, who had been easing into the chief executive's role he was to have formally assumed today. Speculation about the cause doesn't help. Was Vladimir Putin miffed about an investigation by the Sydney Morning Herald? Perhaps China was engaging in a further show of strength? Certainly Nine has concluded a "state actor" was the most likely cause.

Disconnected from the internet following the attack, the Australian media giant has had to resort to a variety of workarounds to keep the show on the road while systems were patched and repaired.

Much was made of TV newsrooms reverting to whiteboards, Textas and mobile apps to maintain live broadacsts, and print editions of the group's metro mastheads were also affected. Slack was apparently used as an alternative to email.

Chief information and technology officer Damian Cronan was quoted that they had isolated the attacker and "the specific destructive activity that was initiated", but that a containment strategy had seen all internal networks - such as broadcast from publishing, and Sydney from Melbourne - separated from one another.

Colourfully, Melbourne news director Hugh Nailon said (in Guardian Australia) "basically the Ferrari wouldn't start and we had to fire up the Datsun 180B", taking broadcasts "back to TV in 1986".

The company had centralised its Sydney broadcast and the publishing activities of its former Fairfax teams at a new "creative campus" across nine floors of North Sydney's 1 Denison Street (pictured) during the second half of last year, although news teams are still separate.

Throughout the post attack period, agility, flexibility and innovation have been keywords, with Sneesby praising the rapid reaction of tech teams allowing live broadcasts to continue and minimising broader impacts. "I've seen countless cases of leadership, ingenuity and resilience as we pivoted quickly in key areas of our business to operate around current limitations," he had commented on Monday.

For decades now, we've been writing about disaster recovery systems as publishers became more dependent upon increasingly smart software - in the former Fairfax's case, using centres some of which they don't even own any more. Last night, a feature on cyber crime on Nine's A Current Affair had a single recurring message: Plan ahead.

Peter Coleman