Mandatory Ransomware Payment Reporting in Australia

Starting May 29, 2025, a new reporting obligation has been implemented in Australia. Businesses facing ransomware attacks must now disclose any payments made. This new regulation aims to bring transparency and accountability in the face of increasing cyber threats.

What Must Be Reported?

If a business makes or becomes aware of a ransomware payment, it must report this to a designated government agency within 72 hours. The gravity of this requirement is underscored by the substantial penalties for non-compliance, reaching nearly AU$20,000. This initiative underscores the importance of transparency and quick response in cybersecurity incidents.

Who Is Affected?

This regulation particularly affects “reporting business entities,” primarily those with annual turnovers over AU$3 million. It also includes entities governed by the Security of Critical Infrastructure Act 2018. Clearly, the focus is on larger organizations that play a critical role in national infrastructure and economic stability.

Submission Process

The Australian Signals Directorate (ASD) is responsible for receiving these reports. It offers an online platform where businesses can disclose relevant information securely and efficiently. This structured approach aids in streamlining the reporting process.

Understanding the Broader Context

The ASD strongly advises against paying ransoms due to the untrustworthy nature of cybercriminals. However, some businesses find themselves in unavoidable situations. A recent survey revealed that the average ransom paid by Australian companies in 2024 was around AU$1.35 million, highlighting the economic impact of these attacks. Thus, maintaining robust cybersecurity practices and an updated Data Breach Response Plan is crucial.

Stay informed and prepared. For personalized cybersecurity solutions and expert guidance, contact Qsentinel today.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.