Since 30 May 2025, Part 3 of the Cyber Security Act 2024 has required certain businesses to report ransomware and cyber extortion payments to the Australian Signals Directorate within 72 hours. If your turnover was over $3 million in the last financial year, it almost certainly applies to you.
Who has to report
- Businesses carrying on business in Australia with annual turnover over $3 million in the previous financial year. The threshold is set by the Cyber Security (Ransomware Payment Reporting) Rules 2025.
- Responsible entities for critical infrastructure assets under the Security of Critical Infrastructure Act 2018, whatever their turnover.
What triggers the clock
The obligation is triggered by a payment, not by the attack itself. The 72 hours run from when you make the payment, or from when you become aware that a payment was made on your behalf, for example by an insurer or a negotiator. The duty to report stays with your business either way.
“Payment” is broader than money in a bank account. Cryptocurrency and other benefits given in response to an extortion demand count too.
How to report
Reports go to the ASD through cyber.gov.au. They cover who you are, what happened, the demand that was made, the payment and the communications with the attackers. Information in a report is protected by limited-use provisions in the Act, which restrict how the government can use it.
The ransomware payment report is separate from your other duties. If personal information was involved, the Notifiable Data Breaches scheme may also require you to notify the OAIC and affected people.
Prepare now, not at 3 am
- Confirm whether you are a reporting business entity, and record the answer in your incident response plan.
- Decide in advance who can approve a payment, and who is responsible for the report if one is made.
- Read your cyber insurance policy for conditions about payments, negotiators and response panels, and agree how your insurer will tell you if it pays.
- Keep a short template with the details a report needs, so nobody is hunting for them mid-incident.
- Run a tabletop exercise once a year that includes the decision to pay, or not, and the report.
Better still: don’t be in that position
Paying doesn’t guarantee your data back or kept private. The businesses that refuse with confidence are the ones with offline or immutable backups that have been tested, and someone watching their systems who can stop an attack before encryption starts.
If you are dealing with ransomware now, call our incident line. To prepare, book a free refinement of your incident plan and backups.
Sources
- 1.Cyber Security (Ransomware Payment Reporting) Rules 2025: explanatory statement, Federal Register of Legislation
- 2.Pay and tell: mandatory ransomware payment reporting obligations in force, MinterEllison
- 3.Australia’s new ransomware payment reporting law takes effect, BakerHostetler
