DLA Piper took down its systems after the attack and posted a notice on its website saying: "We are currently dealing with a serious global cyber incident.
"We have taken down our systems as a precautionary measure which will mean you are currently unable to contact us by email or landline. Our people continue to be available on their usual mobile/cell phone numbers."
The ABC quoted an union official at the Cadbury facility in Claremont had stopped production at about 9.30pm AEDT on Tuesday.
"If you see this text then your files are no longer accessible, because they have been encrypted.
"Perhaps you are busy looking for a way to recover your files, but don't waste your time."
"Please follow the instructions: send $300 worth of bitcoin to the following address."