Pay The Price, Now 'Fess Up': Reporting Obligations For Ransomware Payments Are Live

As of 29 May 2025, the requirement on businesses to report ransomware payments they make has come into effect.

What is the Requirement?

If a reporting business entity becomes impacted by a cyber security incident and ends up making a ransomware payment in response to the incident, the business must report the ransomware payment to the designated government agency within 72 hours after making the payment or becoming aware that the payment was made. Entities who do not produce a satisfactory report within the required time can be liable to a civil penalty of almost AU$20,000.

Who Does it Apply to?

'Reporting business entities' – generally those with over AU$3 million turnover. Certain entities under the Security of Critical Infrastructure Act 2018 are also within scope.