Ransomware Payment Reporting Check (AU)

Part 3 of the Cyber Security Act 2024 (Cth) requires businesses carrying on business in Australia with an annual turnover above $3 million, and responsible entities for critical infrastructure assets, to report to the Australian Signals Directorate within 72 hours if they make, or someone makes on their behalf, a ransomware or cyber extortion payment. The obligation has been in force since 30 May 2025, and after an initial education-focused phase the regulator now expects full compliance. The report must cover the incident, the payment made, the demand and any communications with the attacker, and the Act limits how that information can be used against the reporting business.

Failing to report can attract a civil penalty under section 27 of the Act. A ransomware attack is also likely to be an eligible data breach under Part IIIC of the Privacy Act 1988, which requires most businesses with turnover above $3 million (and some smaller ones, such as health service providers) to notify the OAIC and affected individuals as soon as practicable, with serious or repeated privacy interferences carrying penalties of up to $50 million or more. Directors who have not prepared for cyber incidents also risk breaching their duty of care under section 180 of the Corporations Act 2001, as ASIC has repeatedly warned. Even smaller businesses below the threshold benefit from a clear incident plan and voluntary reporting to the ACSC.

Use this free ransomware payment reporting check to see whether your business must report to the Australian Signals Directorate within 72 hours, and how ready you are for a ransomware attack.