Mandatory Ransomware Payment Reporting: Does It Apply to Your Business?

For most businesses reading this, the answer is yes, and that comes as a surprise to a great many of them.

Since 30 May 2025, Australian businesses with an annual turnover of three million dollars or more have been legally required to report ransomware and cyber extortion payments to the Australian Signals Directorate within seventy-two hours. It is a short obligation sitting in a piece of legislation most business owners have never heard of, and in our experience it is one of the least understood legal duties currently applying to Australian businesses.

The three million dollar threshold is the part worth pausing on. A business running fifteen to a hundred and fifty computers is, in almost every case, comfortably above it. If you have been assuming this is something that applies to larger organisations, it is worth checking your last financial year rather than assuming.

What the Law Actually Says

The obligation sits in Part 3 of the Cyber Security Act 2024, which received Royal Assent on 29 November 2024 and is Australia’s first standalone piece of cyber security legislation. The ransomware reporting provisions commenced on 30 May 2025.

It captures what the Act calls a reporting business entity, which means one of two things. Either you carry on business in Australia and had an annual turnover of three million dollars or more in the previous financial year, or you are the responsible entity for a critical infrastructure asset under the Security of Critical Infrastructure Act, in which case turnover is irrelevant. Businesses below the threshold, along with Commonwealth and State bodies, sit outside it.

Where the obligation applies, the requirement is straightforward. If you make a ransomware or cyber extortion payment, or become aware that someone has made one on your behalf, you have seventy-two hours to report it using the form on the ASD’s website.

A few details catch people out. There is no minimum payment threshold, so a small payment is as reportable as a large one. Payment is not limited to money — non-monetary benefits such as goods or services provided to an extorting entity count. Payments made overseas are captured. And the obligation is triggered by the payment, not by the demand: receiving a ransom demand and refusing to pay creates no reporting duty under this provision, though you would be well advised to report the incident to the ASD anyway.

Where the Seventy-Two Hours Actually Starts

This is the part that quietly creates the most exposure, and it is worth understanding before you are ever in a position to need it.

The clock runs from the moment the payment is made, or from the moment you become aware that a payment was made on your behalf. In a real incident, the payment is very rarely made by the business itself. It is made by a cyber insurer, an incident response firm, a specialist negotiator, or a law firm acting on instructions.

That creates a genuine trap. If your insurer settles a demand on a Thursday and nobody tells you until the following Monday, the obligation attached the moment you became aware — but the surrounding chaos of an active incident is precisely the environment in which three days disappear without anyone noticing. We would suggest that anyone who might make a payment on your behalf needs to know, in advance and in writing, that they are to tell you immediately when they do. That single clause in an engagement letter is a great deal cheaper than finding out afterwards.

It is also worth being realistic about what those seventy-two hours look like in practice. They are not three clear days. They are three days during which systems are down, staff cannot work, customers are asking questions, lawyers are involved, and somebody is trying to establish what was taken. The reporting form itself is not difficult. Remembering it exists, while all of that is happening, is the hard part.

What Has to Go in the Report

The report goes to the ASD through the form at cyber.gov.au. Broadly, it covers your entity’s details, the nature of the incident, the demand that was made, information about the extorting entity, the amount paid and how the payment was made, along with any other relevant detail about the incident.

There is a useful protection attached. Information contained in a ransomware payment report is generally not admissible in criminal or civil proceedings against the reporting entity, and the obligation to report does not override legal professional privilege. There are narrow exceptions, including for false statements. The intent of the regime is intelligence gathering rather than prosecution of victims, which is worth knowing if the instinct in the room is to say nothing.

That protection applies to the report itself. It does not create immunity under other legislation, and it does not make the underlying incident go away.

The Education Period Has Ended

Home Affairs ran the first six months of the regime, from 30 May 2025 to 31 December 2025, as an education-first phase. During that period it pursued regulatory action only in cases of egregious non-compliance, while socialising the reporting form and identifying practical barriers to compliance.

That phase is finished. From 1 January 2026 the Department moved to an enforcement-oriented posture, on the stated expectation that reporting entities would by then have revised their incident response plans and put procedures in place to report within the required timeframe. Non-compliance now risks regulatory action as a matter of routine.

Failing to report within the required time attracts a civil penalty of up to sixty penalty units, currently $19,800.

We would gently observe that the penalty is not really the point. A business that has just paid a ransom has considerably larger problems than a fine of that size. The more meaningful risk is what a failure to report says about the organisation’s controls at precisely the moment its insurer, its clients and possibly a regulator are all looking closely at that question.

Two Clocks, Two Regulators

Here is something most coverage of this obligation misses entirely, and it matters more than the reporting form does.

Modern ransomware rarely just encrypts. The standard approach now is to take a copy of the data first and threaten to publish it, which means a ransomware incident is usually also a data breach. If personal information was involved, you are dealing with two separate regimes at once.

Under the Cyber Security Act, you have seventy-two hours from payment to report to the ASD. Under the Privacy Act’s notifiable data breaches scheme, where you suspect an eligible breach you have thirty days to complete a reasonable and expeditious assessment, and if it is an eligible breach you must notify both the OAIC and the affected individuals. Two obligations, two timeframes, two bodies, running in parallel rather than one substituting for the other.

If you would like the detail on the second of those, our guide to the Privacy Act changes covers it properly.

The practical implication is that an incident response plan built only around getting systems back online is incomplete. Somebody needs to own the regulatory clocks while somebody else owns the recovery, and in a business of this size that is usually a conversation to have with your IT provider well before anything happens.

Is Paying Even Legal?

Paying a ransom is not, in itself, unlawful in Australia. The Government’s position is clearly that you should not — payment does not guarantee recovery, and it sustains the business model that produced the attack in the first place — but the decision remains yours.

There is one significant qualification. If the payment goes to an entity designated under Australia’s autonomous sanctions regime, that is a criminal offence under separate legislation. Since ransomware groups are not in the habit of identifying themselves accurately, this is not a question a business can answer in the middle of an incident on its own. It is one of several reasons that specialist advice belongs in the room before any payment is contemplated.

It is also worth keeping detailed records of all communications with the attackers, including any pre-payment negotiations. Where a payment is reported, the ASD is likely to want that material.

The Better Question

We will be direct about something, because it is the most useful thing in this article.

The reporting obligation only bites if you pay. The more valuable question is why your business would ever be in a position where paying looks like the rational choice, and the answer, almost invariably, comes down to backups.

Organisations pay because restoring is not an option. Either the backups were encrypted alongside everything else, because they were reachable from the same network with the same credentials, or nobody had verified that a restore actually worked and the discovery that it does not arrives at the worst possible moment. A backup job that reports success every night for two years tells you the job ran. It does not tell you the data is recoverable.

An organisation with immutable backups held separately from the production environment, tested by performing genuine restores rather than by reading a status report, has a difficult decision to make about reputational damage and stolen data. An organisation without them has no decision at all. That difference is the whole of it, and it is considerably cheaper to build than a ransom is to pay.

What to Have Ready Now

None of the following takes long, and all of it is far easier to arrange before an incident than during one.

Confirm whether you are above the three million dollar threshold, and whether you hold a critical infrastructure asset. Write the obligation into your incident response plan, naming the person responsible for making the report rather than leaving it to whoever turns out to be least busy. Make sure anyone who might make a payment on your behalf — insurer, broker, legal adviser, response firm — is instructed to notify you immediately if they do. Know where the ASD reporting form is before you need it.

Then attend to the part that determines whether any of this is ever relevant: make sure your backups are separated, immutable, and tested by actually restoring from them.

We should note that we are an IT provider rather than a law firm. We can tell you whether your environment and your response plan would stand up, and fix them where they would not. For advice on how these obligations apply to your particular circumstances, and certainly before making any payment, speak to a lawyer.

Frequently Asked Questions

Who has to report a ransomware payment in Australia? Businesses carrying on business in Australia with an annual turnover of three million dollars or more in the previous financial year, and responsible entities for critical infrastructure assets regardless of turnover. Businesses below the threshold and Commonwealth and State bodies are not captured.

How long do I have to report? Seventy-two hours from making the payment, or from becoming aware that a payment was made on your behalf.

Is there a minimum payment amount before it becomes reportable? No. Any payment is reportable, and the obligation extends to non-monetary benefits provided to an extorting entity.

What if my insurer pays the ransom rather than us? It remains your obligation to report. The seventy-two hours runs from when you become aware the payment was made, which is why anyone acting on your behalf should be instructed to tell you immediately.

Do I have to report if I receive a demand but do not pay? Not under this provision — the obligation is triggered by payment. Reporting the incident to the ASD anyway is strongly encouraged, and other obligations such as the notifiable data breach scheme may still apply.

Is it illegal to pay a ransom in Australia? Not in itself. However, paying an entity designated under Australia’s sanctions regime is a criminal offence under separate legislation, and Government guidance is not to pay. Take legal advice before any payment is made.

What happens if we do not report? Failing to report within the required time attracts a civil penalty of up to sixty penalty units, currently $19,800. Home Affairs ran an education-first period to 31 December 2025 and has taken an active enforcement posture since 1 January 2026.

Does reporting to the ASD satisfy our Privacy Act obligations? No. They are separate regimes. A ransomware incident involving personal information will usually trigger obligations under both the Cyber Security Act and the notifiable data breaches scheme, with different timeframes and different recipients.

Where to Start

Most businesses we speak to about this have never read the obligation and have no line in their incident response plan covering it. That is worth fixing, and it takes an afternoon.

The larger piece of work is making sure you never need it. Our TechSecure assessment reviews your backup and recovery arrangements alongside identity, access and system configuration, and produces a register of risks with practical steps for addressing them. Tested, separated backups are consistently the single control that determines how a ransomware incident ends.

Want to know whether your business could recover without paying? Contact our friendly Brisbane team for a chat today.

Read more about TechSecure, our cyber security assessment