Ransomware payment reporting in Australia: who must report, to whom, and by when

Your files are encrypted, a countdown timer is running, and someone has just asked whether anyone’s going to pay. Before that conversation goes any further, there’s a rule to know about. If your business turns over more than $3 million a year and a ransom is paid, by you or on your behalf, you must report it within 72 hours.

Below: who the rule covers, how the clock works, what to do first, and what applies if you’re under the line.

Does my business have to report a ransomware payment?

The reporting duty sits in the Cyber Security Act 2024 and began on 30 May 2025. The duty lands on you if either of these describes your business:

Test	What it means
Turnover	More than $3 million a year in turnover, looking at your last financial year
Critical infrastructure	You run a critical infrastructure asset covered by the Security of Critical Infrastructure Act 2018, at any turnover

Two details owners miss:

• The test is turnover, not the ransom. A $5,000 payment by a $4 million business is reportable.
• It’s triggered by a payment. The rule covers a ransomware or cyber extortion payment. An attack where nobody pays isn’t caught by this rule, though it’s still worth telling the authorities about (see below).

If you’re near the threshold, check the official definition on cyber.gov.au, because related businesses and group structures can complicate the maths. Ask your accountant for the turnover figure now, not at hour 70.

When does the 72-hour clock start?

The clock starts when money changes hands, or when you learn someone else paid for you. The second trigger matters, because the Home Affairs factsheet treats a payment by another party for you as reportable too. In practice that covers:

• your cyber insurer paying through an incident response firm;
• a managed IT provider or negotiator paying out of their own account and billing you later;
• a director paying from a personal account to “make it go away”.

Settle one thing in writing before anyone pays: who lodges the report. If you assume the insurer will, and the insurer assumes you will, the 72 hours expires without a report. Record the date and time you were told about any payment.

Phase 2 of the regime began on 1 January 2026. From that date the government moved from an education-first approach to active compliance, and failing to report can attract a civil penalty of 60 penalty units. The sources I checked quote a figure of about $19,800, but penalty unit values are indexed, so check the current value rather than relying on that number.

What should we do in the first 72 hours?

An emergency-kit order. Free help first, decisions second, money last.

1. Isolate, don’t wipe. Disconnect affected machines from the network, but don’t reformat anything. Evidence and recovery options are on those disks.
2. Call the Australian Cyber Security Hotline: 1300 CYBER1 (1300 292 371). It’s free and it’s the fastest route to someone who sees these attacks daily.
3. Call IDCARE’s small business line: 1800 595 170. It’s free, and it helps with the human side as well as the technical.
4. Phone your insurer before you touch the ransom question. Cyber policies usually require notice and approval of the response firm, and paying without consent can void cover. Read the wording on extortion payments.
5. Start a log. Times, who said what, ransom note screenshots, wallet addresses, every message with the attacker. The report asks for these details.
6. Decide who is allowed to speak to the attacker. One named person or the response firm, nobody else.
7. Tell your bank if payroll or payment systems are affected, and switch to manual payment methods for the week.

Our emergency action checklist walks the same order if you’d like a printable version.

What goes into the report?

You report through the form on cyber.gov.au. The Act sets a minimum list, and you’re expected to include what you know or can reasonably work out. Expect questions on:

• who you are and your contact details;
• a description of the incident and how it affected you;
• the demand made by the attacker and any contact details they gave;
• the amount and form of the payment, and when it was made;
• a brief description of any negotiation before payment.

If you don’t have every answer within 72 hours, report what you have. A log started on day one makes that straightforward. The government’s published material says reports are protected from being used against you in most proceedings, and that reporting doesn’t waive legal privilege. Confirm the current detail on the official page.

What if we’re under $3 million turnover?

Most small businesses are. The payment rule doesn’t bind you, but you still have three things to think about:

1. Report the attack anyway. The hotline and cyber.gov.au accept reports from any business. Your report helps others, and you get advice back.
2. Check the privacy rules. If personal information was likely accessed and your business is covered by the Privacy Act, the OAIC’s Notifiable Data Breaches scheme may require you to notify affected people and the regulator when the breach is likely to cause serious harm. The Privacy Act generally covers businesses above $3 million turnover, and also some smaller ones, such as health service providers. Read the OAIC guidance.
3. Don’t assume paying works. Payment is not a guarantee of getting data back, and it can mark you as a payer. That’s a decision for you, your insurer and your response firm, not for this guide.

Illustrative example only: a landscaping supplier with $2.2 million turnover loses its job-costing system to ransomware. It’s under the threshold, so no payment report is required. The owner phones the hotline and IDCARE on day one, tells the insurer, restores from a backup that was two weeks old, and rebuilds the missing fortnight of job records from emails and phone logs. No ransom is paid. What hurts is the cash: it can’t invoice for ten days.

How do you cover the cash gap after an attack?

Ransom aside, an attack usually costs you in three ways: days of lost trading, response and rebuild fees before the insurer pays, and invoices you can’t send. That’s a cash flow problem, and it’s one you can measure.

• Build a quick 13-week recovery forecast so you know the real shortfall rather than the scary one.
• Check what the policy will pay, and when. Many policies reimburse after the work is done.
• Ask suppliers and your landlord for short extensions while you’re offline, in writing.
• Fund only the gap that’s left.

If there’s a gap that free help and your policy won’t close in time, a short enquiry is a sensible next step. Unsecured funding sized on your bank statements, or a property-secured facility if the number is bigger, are the usual routes. See unsecured emergency cash for how that works.

What should you set up before an attack?

The best 72 hours are the ones where you’ve already decided things. Ten minutes this week:

• Find out your last-financial-year turnover and note whether you’re above or below $3 million.
• Read your cyber policy’s extortion and consent clauses. Write the insurer’s 24-hour claims number in your one-page continuity plan.
• Agree who talks to the attacker, who lodges reports, and who calls the bank.
• Keep an offline or immutable backup, and test a restore.
• Put the hotline and IDCARE numbers on the wall.

Attackers also pose as suppliers and customers once they’re inside your email, so brush up on payment redirection scams. The wider recovery picture is on our cyber attack page.

Where does that leave you?

A ransomware attack is a bad week, not the end of the business. The legal question has a simple answer: above $3 million and a payment made, you report within 72 hours. Below it, report voluntarily and check privacy duties.

If the attack has left a hole in your cash, we’d rather you check the free routes first, and then talk to us about the gap. Enquiring takes about 60 seconds and there’s no credit check when you enquire, so asking won’t touch your credit score. We don’t spray your details around lenders, so there’s no flood of calls; a real person reads your situation and phones you. Please fill the form in accurately, with the sum, what it’s for, your state and any property, so we can match you to the right option first time.

Find out where you stand →