Paid a ransom? Australia’s 72-hour reporting rule explained

If your business turns over more than $3 million, or runs critical infrastructure, and pays a ransom or extortion demand, you have 72 hours to report it to the Government. This guide covers who must report, what counts as a payment, what the report must contain and a one-page timeline to plan around.

General information, not legal advice. Get legal advice for your own situation, ideally before any payment is made.

What does the law actually require?

Part 3 of the Cyber Security Act 2024 creates the obligation. It commenced in late May 2025: the Federal Register lists 29 May 2025, and the Department of Home Affairs, which administers the Act, says reporting has been active since 30 May 2025.

Section 27(1) is the core rule: the reporting business entity must give the designated Commonwealth body a ransomware payment report "within 72 hours of making the ransomware payment or becoming aware that the ransomware payment has been made (whichever is applicable)".

Section 26 sets out when Part 3 applies. In plain English, all five must be true:

1. A cyber security incident has occurred, is occurring or is imminent.
2. It has had, is having, or could reasonably be expected to have a direct or indirect impact on your business.
3. Someone (the "extorting entity") makes a demand of you, or of anyone else, to benefit from the incident or its impact on you.
4. You provide a payment or benefit to the extorting entity, or you’re aware someone else provided one on your behalf.
5. The payment is directly related to the demand.

The report goes to a "designated Commonwealth body". Unless rules name a different one, section 8 makes that the Department of Home Affairs and the Australian Signals Directorate (ASD). In practice you file through ASD’s form on cyber.gov.au. Home Affairs monitors compliance; its factsheet says ASD "does not serve as a regulator".

Does this apply to us?

Work through this checklist. If every box in section A is ticked, plan on the assumption that you must report.

A. Are we a reporting business entity? (tick one)

• We carry on a business in Australia, our annual turnover for the previous financial year exceeded A$3 million, and we are not a Commonwealth body or State body; or
• We are the responsible entity for a critical infrastructure asset to which Part 2B of the Security of Critical Infrastructure Act 2018 applies (turnover doesn’t matter).
• If we only traded for part of last financial year: we’ve applied the part-year formula in section 6 of the Rules (A$3 million × days traded ÷ days in that financial year). Home Affairs’ example: a business that traded 73 days has a threshold of A$600,000.

Notes: Home Affairs says not-for-profit organisations "are not explicitly exempt". The Act’s test is turnover that exceeds the threshold; the cyber.gov.au form and the Home Affairs factsheet describe it as A$3 million "or more". If you’re close to the line, treat yourself as covered and ask your lawyer.

B. Has a payment been made?

• We paid, or agreed to give, money, cryptocurrency, goods, services or any other benefit to the extorting entity in response to the demand. (Home Affairs says non-monetary benefits count, such as gifts or services.)
• Someone paid on our behalf: a parent company, an overseas office, an insurer, a negotiator or another third party. The 72 hours then runs from when we became aware.
• The incident is a cyber incident, not a physical extortion threat or a scam. (Home Affairs says physical extortion and scams aren’t subject to the mandatory report; scams go to Scamwatch.)

C. When doesn’t it apply?

• A demand was made but no payment was made: no mandatory report. Voluntary reporting through cyber.gov.au is encouraged.
• A supplier or overseas related company paid its own ransom and your systems weren’t affected and nothing was paid for you: Home Affairs’ second scenario says you are not required to report.
• You’re under the turnover threshold and not a critical infrastructure responsible entity: no mandatory ransomware payment report, but other reporting obligations (below) can still apply.

What must the report contain?

Section 27(2) of the Act and section 7 of the Cyber Security (Ransomware Payment Reporting) Rules 2025 set the contents. You must include what you know, or can find out by reasonable search or enquiry, at the time of the report:

• Who paid: contact and business details of the entity that made the payment, including ABN, and of the reporting business entity if a third party paid.
• The incident: when it happened or is estimated to have happened, when you became aware of it, its impact on you and on your customers, the ransomware or malware variant (if any), and any vulnerabilities exploited.
• The demand: the amount or quantum demanded (including non-monetary benefits) and the payment method demanded.
• The payment: what was actually given and how.
• Communications: the nature and timing of communications with the extorting entity, a brief description of them, and any pre-payment negotiations.
• Anything else that could help a Commonwealth or State body respond to, mitigate or resolve the incident (optional).

Check: if you use a negotiator or incident response firm, agree in writing who will capture the communications log, wallet addresses and timeline, and who will file the report. The obligation stays with you even when someone else pays.

How do you report?

Use the Ransomware payment and cyber extortion payment reporting form on cyber.gov.au (also reachable from "Submit a report"). A third party can submit on your behalf, but the form then needs details of both the reporting entity and the entity it is reporting for.

After submission you get a unique reference number. Home Affairs says a copy of the report won’t be provided, so save your own copy of everything you enter before you submit, and record the reference number in your incident log.

Check: someone in your organisation other than the IT lead knows where the form is and has authority to file. The person who normally would might be the one locked out.

What happens if you don’t report?

Failing to report as required is a civil penalty provision carrying 60 penalty units. The Commonwealth penalty unit has been A$364 since 1 July 2026 (it was A$330 before that), so 60 units is A$21,840 for a contravention from that date. The Act enforces this through the Regulatory Powers (Standard Provisions) Act 2014, under which a court can order a body corporate to pay up to five times the listed amount: 300 units, or A$109,200. These are maximums; a court sets the actual penalty.

Home Affairs is phasing in enforcement:

We are in Phase 2 now.

Is paying a ransom legal, and is the report safe to make?

Paying a ransom is not generally prohibited in Australia, but Home Affairs says the Government "strongly discourages" it: payment doesn’t guarantee recovery, doesn’t stop the data being published or sold, and can invite further attacks. Some payments can break other laws, in particular payments to sanctioned people or entities (check the DFAT sanctions list) and obligations under anti-money laundering and counter-terrorism financing law.

The Act protects what you report:

• Limited permitted uses (sections 29 and 30). Report information may only be used for listed purposes, such as helping you respond, the functions of intelligence agencies, and advising Ministers. It must not be used to investigate or enforce other civil or regulatory contraventions by you, other than Part 3 itself or criminal offences.
• Not admissible against you (section 32) in most criminal, civil penalty, civil and tribunal proceedings, with exceptions such as false or misleading information, obstruction, Part 3 penalties, Royal Commissions and coronial inquiries.
• Legal professional privilege (section 31) isn’t otherwise affected by making the report.
• Good faith (section 28). You aren’t liable in damages for acts done in good faith in complying with section 27.

Separately, you can voluntarily share incident information with the National Cyber Security Coordinator under Part 4, which has its own "limited use" protections. Home Affairs is clear that doing so does not meet the section 27 ransomware reporting obligation.

What other reports might the same incident trigger?

A ransomware report is rarely the only one. Typical companions:

• Notifiable Data Breaches (OAIC). If personal information was accessed or stolen and serious harm is likely, you may have to notify the OAIC and affected people. See our guide: Is this data breach notifiable?
• Critical infrastructure incident reporting under the SOCI Act, if you’re a responsible entity.
• Sector regulators and contracts: your insurer, financial services or health regulators, and government clients often have their own notification clauses.
• ASD incident report: you can report the incident itself to ASD through cyber.gov.au ("Submit a report") whether or not you pay.

cyber.gov.au also hosts a "Single Reporting Portal" page that lists Commonwealth reporting requirements a cyber incident can trigger, by industry. It is a list, not a single form.

What is the Cyber Incident Review Board?

Part 5 of the Act creates the Cyber Incident Review Board, which the Minister for Home Affairs announced as established on 4 May 2026. It conducts no-fault, post-incident reviews of significant incidents and makes recommendations to government and industry. Under section 46 a review can be referred by the Minister, the National Cyber Security Coordinator, a Board member or an impacted entity, and can only start after the incident and the immediate response have ended. The incident must meet criteria such as serious prejudice to Australia’s social or economic stability, defence or national security, novel or complex methods, or serious concern to the Australian people. The Act says reviews are not to apportion blame or determine liability.

For most businesses the Board won’t come knocking. It is still worth knowing that a well-kept incident log is what any review, insurer or regulator will ask for first.

One-page response timeline

Use this as a planning aid alongside your incident response plan. It isn’t legal advice, and the legal clock only starts when a payment is made or you become aware of one.

The most reliable way to keep this law theoretical is to never be in a position where paying looks like the only option: tested offline backups, multi-factor authentication everywhere, fast patching of internet-facing systems, and monitoring that spots intruders before encryption starts. Our managed security service and penetration testing are built around those basics.

Key takeaways

• Businesses with turnover above A$3 million, and critical infrastructure responsible entities, must report ransomware or extortion payments within 72 hours.
• The clock starts when you pay or become aware a payment was made for you; a demand alone isn’t reportable (but can still be reported voluntarily).
• The report needs details of the incident, the demand, the payment and your communications with the attacker, so log them from the first minute.
• Failing to report attracts up to 60 penalty units (A$21,840 from 1 July 2026), or up to five times that for a body corporate, and Home Affairs has moved past its education-first phase.
• Report information has strong use limits and is generally inadmissible against you, but sharing with the National Cyber Security Coordinator isn’t a substitute for the report.
• Check the other obligations the same incident triggers, especially the Notifiable Data Breaches scheme.

Sources

• Cyber Security Act 2024 (No. 98, 2024), Parts 3 and 5, Federal Register of Legislation
• Cyber Security (Ransomware Payment Reporting) Rules 2025, sections 6 and 7, Federal Register of Legislation
• Factsheet: Mandatory ransomware and cyber extortion payment reporting, Department of Home Affairs
• Ransomware payment and cyber extortion payment reporting form, cyber.gov.au
• Single Reporting Portal, cyber.gov.au
• Regulatory Powers (Standard Provisions) Act 2014, section 82, Federal Register of Legislation
• Crimes (Amount of a Penalty Unit) Instrument 2026, Federal Register of Legislation, and Penalty units, Australian Financial Security Authority
• Cyber Incident Review Board established, Minister for Home Affairs, 4 May 2026