Ransomware Payment Reporting in Australia

Ransomware payment reporting is now a legal duty for many Australian businesses. If your business pays a ransom, you must tell the Australian Government within 72 hours. The rule has applied since 30 May 2025. This guide explains who must report, when the clock starts, and how to prepare.

Who must follow ransomware payment reporting rules

The duty comes from the Cyber Security Act 2024. It applies to a "reporting business entity". Broadly, that is a business carrying on business in Australia with annual turnover above AUD 3 million in the previous financial year. It also covers the responsible entity for certain critical infrastructure assets under the SOCI Act.

AUD 3 million is a low bar, so many mid-sized businesses are covered. The turnover test is set out in the Rules. Check them, or ask your lawyer, if you are near the threshold.

When the 72-hour clock starts

You must report within 72 hours of making the payment. If a third party or a related company pays on your behalf, the clock starts when you become aware of it. You still carry the duty to report.

A ransom demand alone does not trigger a report. If no payment is made, there is no payment report to file.

What to have ready for the report

The report covers these details:

• Your contact and business details, including your ABN
• Details of the incident
• The extortion demand
• The payment you made
• Your communications with the attacker

You only need to share what you know, or can reasonably find out.

What happens if you do not report

A civil penalty of 60 penalty units can apply for failing to report. The first phase was education-first, and it ran from 30 May to 31 December 2025. Since 1 January 2026, regulators have taken a more active approach.

Reporting is not a reason to pay

ASD's advice is clear: never pay a ransom. There is no guarantee you will get your data back, or stop it being sold or leaked. Paying is a business and legal decision, and the report only records it.

If you are hit, ASD advises a few first steps. Record the details and turn off infected devices. Check that your backups are clean. Then report the incident through ReportCyber.

Plan for the first 72 hours

Treat the 72 hours as part of your incident plan. In the first hours, isolate affected devices and record what you see. Get legal advice early, because paying is a leadership decision with legal effects. If a payment is made, collect the report details as you go, so you are not hunting for them later.

How to prepare before an attack

Do the hard thinking before an incident. Name one person who owns the 72-hour report. Keep your ABN, contact details, an incident log template and your legal contacts in one place. Test that your backups restore cleanly.

Early detection also helps you avoid the payment decision. Breach and attack simulation tests whether your tools catch ransomware behaviour. A 24/7 security operations centre helps you spot and contain an attack before files are locked.

How Primary Guard helps

Primary Guard offers Picus breach and attack simulation and an Autonomous SOC for Australian businesses. Our Ransomware Recovery Center also offers a free triage tool that identifies the attack type and gives a recovery roadmap.

Not sure how ready your team is for a ransomware incident? Primary Guard offers a free assessment to start the conversation.

Frequently asked questions

Is a report to ASD kept private?

Reports have strong legal protections. The Cyber Security Act limits how the information can be used and shared. Report information is also generally not admissible in most court or tribunal proceedings, with some listed exceptions.

Does a voluntary report to ASD count?

No. A voluntary disclosure to the Coordinator does not meet the payment reporting duty. You must use the official ransomware payment report form.

Is this the same as reporting a data breach?

No. The payment report is a separate duty. ASD advises checking for other reporting duties too, such as telling the OAIC about an eligible data breach. Ask your lawyer which apply to you.

Key takeaway

If you pay a ransom, report it within 72 hours. Better still, prepare now so you never face that choice under pressure.

Sources

Home Affairs factsheet | Home Affairs FAQ | ASD payment reporting | ASD ransomware guide

This article is general information, not legal advice. Details are accurate as of 13 October 2026. Check the Cyber Security Act 2024 and Home Affairs guidance, or speak to a lawyer, for your situation.