Ransomware payment reporting in Australia

Source legislation

Cyber Security Act 2024 (Cth), Part 3, Reporting obligations relating to ransomware and cyber extortion. Royal Assent 29 November 2024, reporting obligation commenced 30 May 2025.

Reporting window

Reports must be made within 72 hours of making the payment, or of becoming aware that a payment has been made on your behalf.

Reporting channel

Reports are lodged through the ASD ReportCyber portal. The report is shared with the Department of Home Affairs but is not in itself a notification to the OAIC under the Privacy Act.

Penalty for non-reporting

Civil penalty of 60 penalty units. Penalty units increase each year. At time of writing the unit is $330, producing a $19,800 penalty per contravention.

Turnover threshold

Annual turnover above $3 million in the previous financial year. Calculated in the same way as the Privacy Act small business operator test.

Critical infrastructure entities

Responsible entities for assets covered by the Security of Critical Infrastructure Act 2018 are caught regardless of turnover.

Commonwealth bodies excluded

Commonwealth bodies are excluded from the reporting obligation in Part 3.

Below-threshold businesses

SMBs under $3 million turnover have no direct reporting obligation, but may still be obligated indirectly through contracts with larger customers or via the Notifiable Data Breaches scheme if personal information is involved.

Includes cryptocurrency and fiat

The obligation applies regardless of how the payment is made, including cryptocurrency, bank transfer, gift cards, or any other transfer of value.

Includes non-monetary benefits

The legislation covers 'other benefits' provided in response to an extortion demand. Hand-delivered goods, services, or information could fall within scope.

Payments by third parties on your behalf

If a cyber insurer, ransom negotiator, or any other third party pays on the entity's behalf, the reporting obligation still sits with the entity.

Does not require payment to be effective

The obligation arises on payment, not on whether the attacker provided a decryptor or honoured the demand.

Identifying details of the reporting entity

Business name, ABN, contact details, and the role of the person lodging the report.

Description of the cyber incident

Nature of the attack, suspected initial access vector, systems affected, and timeline of events.

Details of the extortion demand

What was demanded, in what amount and currency, the identity of the threat actor (if known), and any communication channels used.

Details of the payment made

Amount, currency or asset, wallet address or transfer reference, date and time, and the party that made the payment.

Outcome

Whether the attacker provided a decryptor, returned data, threatened further action, or made follow-on demands.

Reporting form

Reports are lodged via the ReportCyber portal at cyber.gov.au. The portal collects the prescribed categories.

Limited use principle

Information disclosed under Part 3 is restricted in its use against the reporting entity in civil proceedings, subject to exceptions for serious offences and proceedings unrelated to the report itself.

Does not displace other reporting obligations

Reporting under Part 3 does not satisfy obligations under the Privacy Act (Notifiable Data Breaches), the SOCI Act (mandatory incident reporting), or any other regulatory framework.

Sanctions, money laundering and terrorism financing law still applies

Reporting a ransomware payment does not absolve the payer of obligations under Australian sanctions law (DFAT Consolidated List) or anti-money-laundering and counter-terrorism-financing law.

Internal legal privilege

Reports are administrative disclosures rather than legally privileged communications. Affected entities typically retain external counsel separately to manage privilege over the broader incident.

Pre-fill entity identifiers

ABN, legal name, registered office, designated incident response contact and after-hours phone number. None of this changes under stress.

Maintain an asset register

Identifying the systems affected during an incident is materially easier when an asset register already exists.

Document the decision authority for payment

Who is authorised to approve a ransom payment, in what amount, under what conditions. Most boards have never written this down.

Engage a ransom negotiator and counsel in advance

Choosing a negotiator and external counsel during the 72-hour window is far harder than retaining them under a standing arrangement.

Run a quarterly tabletop exercise

Walk through a hypothetical incident from detection through to the lodging of an ASD report. Most teams find that 72 hours is genuinely tight.

Align with the Notifiable Data Breach process

If personal information is involved, the OAIC notification clock (30 days for assessment, then notify) runs in parallel with the 72-hour ASD clock.