Ransomware attacks are not a rare event in Australia anymore. They are a regular feature of the business risk landscape, and until recently, most organisations that paid a ransom did so quietly, with no obligation to tell anyone.
That has changed. The mandatory ransomware and cyber extortion reporting regime under the Cyber Security Act 2024 officially commenced on 30 May 2025, requiring entities to report ransomware and cyber extortion incidents where a ransom has been demanded and paid. If your business falls within the reporting threshold and you make a ransomware payment without reporting it, you are already in breach of Australian law.
Here is what the obligation means in plain terms, who it applies to, and what your business needs to have in place before an incident occurs.
What the Cyber Security Act 2024 Actually Does
The Cyber Security Act 2024 received Royal Assent on 29 November 2024 and introduced four significant measures into Australian law. One of those measures is the mandatory ransomware payment reporting obligation, a first for Australia and a meaningful shift in how the government expects businesses to engage with cyber incidents.
The rationale is straightforward. Ransomware attacks have been significantly underreported, which limits the government’s ability to understand the scale of the problem, support affected businesses, and disrupt criminal operations. Mandatory reporting changes that, not by punishing victims, but by building the intelligence picture needed to respond effectively.
The Department of Home Affairs and the Australian Signals Directorate administer the regime. Reports are submitted through the ASD’s ReportCyber platform.
Who Needs to Comply
If your business has an annual turnover exceeding $3 million or is responsible for critical infrastructure assets covered under Part 2B of the Security of Critical Infrastructure Act 2018, you are required to report ransomware or cyber extortion payments.
In practical terms, that threshold captures a significant portion of mid-sized Australian businesses, not just large corporations. If your revenue crossed $3 million in the previous financial year and you operate in Australia, the obligation applies to you.
Not-for-profit organisations are not explicitly exempt, and where a third party makes a ransomware payment on behalf of a reporting business entity, the reporting business entity remains responsible for submitting the report.
That last point is important. If your insurer, IT provider, or legal team facilitates a ransom payment on your behalf, the reporting obligation does not transfer to them. It stays with your organisation.
The 72-Hour Window — What It Actually Requires
Reports must be submitted within 72 hours of making the payment or becoming aware that a payment has been made on your behalf.
Seventy-two hours sounds manageable until you consider what is happening in parallel during an active ransomware incident. Systems are potentially down. Legal counsel is being engaged. The executive team is in crisis mode. IT is working to contain the damage. And somewhere in that chaos, a report needs to be prepared and submitted to the government with accurate information about the incident.
That window cannot be met without preparation. The businesses that will meet the 72-hour deadline are not the ones that discover the reporting obligation during the incident. They are the ones that built a cyber incident response plan before any incident occurred – with a clear escalation pathway, identified reporting responsibilities, and a documented process that does not rely on someone remembering a legal obligation while managing an active attack.
What the Report Must Include
The Cyber Security (Ransomware Payment Reporting) Rules 2025 specify what information must be included in a report. This covers details about the incident itself – when it occurred, how it was identified, what systems and customers were affected – as well as information about the payment, including how it was made and the amount involved.
Collecting this information accurately under time pressure is significantly harder without pre-existing documentation. Incident logs, system access records, payment authorisation trails, and communication records all feed into what a compliant report requires.
The Limited Use Protection — Why Reporting Is Safer Than It Sounds
One of the most significant governance features of the Cyber Security Act 2024 is the Limited Use provision. Information provided to the National Cyber Security Coordinator during or after a cyber incident cannot be used for civil or regulatory action against the reporting entity.
In plain terms, reporting a ransomware payment will not trigger a separate investigation into your business for having made the payment. The obligation is designed to support victims and build intelligence, not to punish organisations that found themselves in an impossible position.
This limited-use protection removes one of the key reasons businesses historically stayed silent about ransomware incidents. There is now a legal framework that encourages transparency while protecting the reporting entity from the information being used against them.
What Good Governance Looks Like Before an Incident
The 72-hour reporting obligation is not just a compliance task. It is a governance stress test. If your organisation cannot meet a 72-hour reporting window during an active incident, the broader question is whether your cyber risk governance is functioning at the level the Cyber Security Act now expects.
A prepared organisation has:
A documented incident response plan that includes the ransomware reporting obligation and assigns clear responsibilities.
A named internal owner for cyber security governance, not just an IT function, but a leadership-level accountability.
Pre-identified legal and communications support that can be activated immediately.
A documented process for authorising and recording any ransom payment decision.
Board-level visibility over cyber risk as a material operational and legal exposure, including cyber security governance.
By mandating incident reporting, the government aims to build a clearer picture of the threat landscape, deliver tailored support to affected entities, disrupt criminal operations, and strengthen Australia’s national cyber resilience. That goal only works if businesses are structured to comply when the moment arrives.
At Anitech, we work with Australian businesses to build the governance frameworks that sit behind cyber compliance obligations, connecting incident response planning to leadership accountability structures and documented risk ownership. If your organisation has not yet reviewed its cyber governance position against the Cyber Security Act 2024 requirements, that review is worth completing now. Visit anitechgroup.com.
Recent Comments