Do You Have to Report a Ransomware Payment in Australia? Obligations Under the Cyber Security Act 2024
Yes, if your business is a reporting business entity: broadly, one carrying on business in Australia with annual turnover above $3 million, or a responsible entity for certain critical infrastructure assets. A ransomware or cyber extortion payment must be reported within 72 hours of paying, or of becoming aware a payment was made on your behalf.
Written and reviewed by The Technology Office · Independent technology advisory
Key takeaways
- Mandatory ransomware payment reporting under Part 3 of the Cyber Security Act 2024 commenced on 30 May 2025.
- It applies to businesses carrying on business in Australia with prior-year turnover above $3 million, and to responsible entities for critical infrastructure assets under Part 2B of the SOCI Act regardless of turnover.
- Reports go to the Australian Signals Directorate within 72 hours of making the payment or becoming aware a payment was made on your behalf, and payments include non-monetary benefits.
- The reporting duty sits alongside other obligations, such as the Notifiable Data Breaches scheme and sanctions laws, so incident plans need a clear decision and reporting workflow.
The short answer
If your business turns over more than $3 million a year, or is responsible for a regulated critical infrastructure asset, and a ransomware or cyber extortion payment is made, you must report it to the Australian Signals Directorate (ASD) within 72 hours. The obligation comes from Part 3 of the Cyber Security Act 2024 and has applied since 30 May 2025. The clock starts when the payment is made, or when you become aware someone paid on your behalf.
This is general information, not legal advice. Thresholds and rules are set by the Act and subordinate Rules, which can change. Confirm current requirements with the Department of Home Affairs, the ASD and your legal adviser.
What does the Cyber Security Act 2024 require?
The Cyber Security Act 2024 received Royal Assent in November 2024 and introduced several measures, including smart device security standards, a Cyber Incident Review Board, limited-use protections for information shared with the National Cyber Security Coordinator, and mandatory reporting of ransomware and cyber extortion payments.
The reporting obligation applies when four conditions are met:
- A cyber security incident has occurred, is occurring or is imminent.
- The incident has had, is having or could reasonably be expected to have a direct or indirect impact on a reporting business entity.
- An extorting entity makes a demand in order to benefit from the incident or its impact.
- The reporting business entity provides a payment or benefit, or is aware that another entity has provided one on its behalf.
Receiving a demand is not enough on its own. The duty is triggered by a payment.
Who is a "reporting business entity"?
| Test | Who it captures | Notes |
|---|---|---|
| Turnover threshold | Entities carrying on business in Australia with annual turnover for the previous financial year above $3 million | The threshold is set in the Rules and is pro-rated if the business traded for only part of the year |
| Critical infrastructure | Responsible entities for critical infrastructure assets to which Part 2B of the Security of Critical Infrastructure Act 2018 applies | Captured regardless of turnover |
| Exclusions | Commonwealth bodies and State bodies | Not reporting business entities |
Home Affairs notes that not-for-profit organisations are not explicitly exempt. If your organisation carries on business and exceeds the turnover threshold, assume the obligation may apply and seek advice.
What counts as a payment?
The definition is broad. It covers monetary and non-monetary benefits provided to an extorting entity in connection with the demand. That could include cryptocurrency, a bank transfer, goods, services or other value. There is no minimum amount.
Payments made by third parties also count. If your insurer, incident response firm, ransom negotiator or parent company pays on your behalf, the report is still your responsibility, and the 72-hour clock runs from when you become aware of it.
What goes in the report, and where is it lodged?
Reports are made to the ASD through its online reporting channel on cyber.gov.au. The Act and Rules prescribe the information required, including:
- your business contact details and ABN;
- details of the incident and its impact;
- the demand made and the extorting entity, where known;
- the payment or benefit provided, including amount and method;
- communications with the extorting entity.
You only need to provide information you know, or can find out by reasonable search or enquiry, within the 72-hour window. Do not delay the report waiting for a complete picture.
The ASD receives reports to help respond to incidents and for its intelligence functions, but it is not the regulator. The Department of Home Affairs administers the regime. Failure to report can attract a civil penalty of up to 60 penalty units. Home Affairs took an education-first approach during the early phase of the regime, but businesses should now treat it as fully enforceable.
How is report information protected?
The Act limits how information in a ransomware payment report can be used and disclosed. Generally, it is not admissible in civil or criminal proceedings against the reporting entity, subject to specific exceptions. Home Affairs has also stated that reporting does not waive legal professional privilege.
Two cautions. First, these protections are not immunity for the underlying conduct. Second, voluntarily sharing information with the National Cyber Security Coordinator does not satisfy the mandatory reporting obligation. You still need to lodge the ransomware payment report.
What other obligations run in parallel?
A ransomware incident rarely triggers just one obligation. Plan for:
| Obligation | Trigger | Who you notify |
|---|---|---|
| Ransomware payment report | A payment is made by or on behalf of a reporting business entity | ASD, within 72 hours |
| Notifiable Data Breaches scheme | An eligible data breach involving personal information likely to cause serious harm | OAIC and affected individuals |
| Critical infrastructure incident reporting | A cyber incident affecting a regulated critical infrastructure asset | As required under the SOCI Act |
| Sanctions laws | Payment to a sanctioned person or entity | Paying a sanctioned party can be a serious offence |
| Contracts and insurance | Notification clauses with customers, lenders and insurers | As set out in each agreement |
Our guide to the Notifiable Data Breaches scheme explains the privacy side in detail.
How should you prepare before an incident?
The 72 hours will feel very short when systems are down. Prepare now:
- Confirm your status each year. Check last financial year's turnover and any critical infrastructure obligations.
- Add a payment decision process to your incident response plan. Define who can approve a payment, the legal and sanctions checks required, and board involvement.
- Name the reporting owner. Assign a person, and a backup, responsible for lodging the report and tracking the clock.
- Align with insurers and advisers. Make sure contracts require them to tell you immediately if they pay on your behalf.
- Prepare a reporting template. Pre-fill business details so only incident facts need adding.
- Rehearse. Run a tabletop exercise covering the payment decision, reporting and parallel privacy notifications.
- Reduce the chance you ever face the decision. Strong controls, such as tested offline backups, MFA and patching aligned to the Essential Eight, make paying less likely to be necessary.
What should the board know?
Directors should be clear on whether the business is a reporting business entity, who has authority to approve a payment, and how the organisation would meet its reporting and notification duties in the first 72 hours. Government advice is not to pay ransoms, and the decision carries legal, ethical and reputational weight. It should never be made ad hoc. See cyber security governance for boards for the wider oversight picture.
Preparing with The Technology Office
The Technology Office helps Australian businesses build incident governance that works under pressure. We are independent and vendor-neutral, with no security products to sell, and we bring a CIO-level, board-ready view of cyber risk. We help leadership teams set clear decision rights for ransom scenarios, embed the 72-hour reporting step in incident plans, and rehearse it.
Through our cybersecurity governance work, and hands-on support via IT crisis management when incidents happen, we work with organisations of any size and industry across Australia. Our reporting to boards is plain English, focused on the decisions directors actually need to make.
Frequently asked questions
Who has to report ransomware payments in Australia?
Reporting business entities under the Cyber Security Act 2024: broadly, entities carrying on business in Australia with annual turnover for the previous financial year above $3 million, plus responsible entities for critical infrastructure assets covered by Part 2B of the Security of Critical Infrastructure Act 2018. Commonwealth and State bodies are not included.
How long do you have to report a ransomware payment?
72 hours from making the payment, or from becoming aware that another party, such as an insurer or negotiator, made a payment on your behalf.
Is paying a ransom illegal in Australia?
Paying a ransom is not generally prohibited, but paying a person or entity subject to Australian sanctions can be a serious offence. Government advice is not to pay, and any payment by a reporting business entity must be reported.
What counts as a ransomware payment?
Both monetary and non-monetary benefits given to an extorting entity in connection with a cyber security incident, such as cryptocurrency, goods or services. There is no minimum payment amount.
Can information in a ransomware report be used against my business?
The Act limits how report information can be used and generally makes it inadmissible in civil and criminal proceedings against the reporting entity, subject to exceptions. Get legal advice during any incident, as protections are not a blanket immunity.
Sources and further reading
- Factsheet: Mandatory ransomware and cyber extortion payment reporting — Department of Home Affairs
- Cyber Security Act 2024 — Federal Register of Legislation
- Notifiable data breaches — Office of the Australian Information Commissioner
Mentioned services
These service and regional NSW pages expand on the topics covered in this article.
Need help applying this?
Bring in senior technology leadership without the full-time overhead.
The Technology Office works with Sydney and regional NSW businesses on embedded CIO support, Head of IT leadership, governance, vendor management, cost optimisation, crisis stabilisation, and no-cost technology reviews as a lighter first step.