Key takeaways
- The Cyber Security Act 2024 (Cth) (Act) introduces mandatory reporting of ransomware and cyber extortion payments as of 30 May 2025.
- Businesses with an annual turnover above $3 million will be required to report ransomware payments.
- A ransomware payment report must be made within 72 hours of making a ransomware payment
- Failing to make a ransomware payment report can result in a maximum penalty of $19,800
Why reform is needed?
According to the Office of Impact Analysis, cyber extortion (particularly ransomware attacks) continues to be a growing threat to Australian businesses and citizens. Ransomware uses malicious software that encrypts devices, folders and files, rendering them inaccessible unless a ransom is paid.
The Australian Cyber Security Strategy prioritises disrupting the ransomware business model and preventing cybercriminals from profiting from attacks on Australian businesses and citizens. However, the under-reporting of ransomware payments has limited the Australian Government’s understanding of the cyber threat landscape, which is critical to addressing increased extortion-related cyber security incidents and developing policy options to break the ransomware business model.
The cyber extortion provisions of the Act are designed to protect Australian people and businesses, mitigate cyber risks and improve the Government’s visibility of the threat environment.
Summary of the proposed Reform
The Act became law on 29 November 2024, and the ransomware reporting obligations commenced from 30 May 2025.
1. Who needs to report?
Reporting obligations will apply to ‘reporting business entities’ defined as businesses with an annual turnover that exceeds the $3 million turnover threshold as well as responsible entities for critical infrastructure assets.
2. When do you need to report?
Reporting obligations will arise if all of the following apply:
- An incident has occurred, is occurring or is imminent;
- The incident is a cyber security incident (this includes ransomware incidents, and other types of cyber extortion e.g. data exfiltration accompanied by a demand and payment);
- The incident has had, is having, or could reasonably be expected to have, a direct or indirect impact on a reporting business entity;
- The extorting entity makes a demand of the reporting business entity in order to benefit from the incident; and
- The reporting business entity provides, or is aware that another entity has provided on their behalf, a payment or benefit (a ransomware payment) to the extorting entity directly related to the demand.
3. What is the deadline to report?
Within 72 hours of making the ransomware payment (or becoming aware that the ransomware payment has been made).
4. How do you make a ransomware payment report?
A report must be made via the portal on the Australian Signals Directorate’s cyber.gov.au website.
The report must contain the following information:
- the contact and business details of the entity that made the payment;
- details of the cyber security incident, including its impact on the reporting business entity;
- the type of demand made by the extorting entity;
- the type of payment made;
- whether you have communicated with the extorting entity relating to the incident, the demand and the payment.
5. What happens if you don't report within 72 hours?
A civil penalty of $19,800 can apply where a reporting business entity does not make a mandatory ransomware payment report when they are obligated to do so.
What steps should your business take now?
Businesses will need to update their cyber incident / data breach response plans to include this requirements, and importantly, businesses will need to factor this into their decision-making as to whether or not they will actually pay a ransom.
Need more information?
If you’d like to learn more about these reporting obligations and how they may impact your business, or assistance with drafting or updating your cyber incident / data breach response plans, please contact a member of the Corporate and Commercial Advisory team and/or Gina Tresidder or Jonathan Teh directly. We would be happy to provide more detailed advice tailored to your circumstances.