Australia's New Ransomware Payment Reporting Law Takes Effect, Covering Both Critical Infrastructure And Other Entities

On May 30, the ransomware payment reporting requirements of Australia's Cyber Security Act 2024 (CSA) took effect. The new requirement applies to a broad range of entities and cyber security incidents, requiring reporting after a "ransomware payment" is made. Australia is the first jurisdiction worldwide to require businesses to report ransomware payments, but pending activity in the United States and the United Kingdom indicate other countries may soon follow.

Scope of Covered Entities

The CSA's ransomware reporting obligation applies to entities that meet either of these two criteria:

• Any entity carrying on business in Australia with annual turnover exceeding AUD $3 million, as set by the Cyber Security (Ransomware Payment Reporting) Rules 2025 (CSA Rules)