{"id":1264,"date":"2026-08-12T10:00:00","date_gmt":"2026-08-12T00:00:00","guid":{"rendered":"https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/"},"modified":"2026-11-03T21:47:12","modified_gmt":"2026-11-03T10:47:12","slug":"ransomware-payment-reporting-australia","status":"publish","type":"post","link":"https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/","title":{"rendered":"Paid a ransom? Australia&#8217;s 72-hour reporting rule explained"},"content":{"rendered":"\n<p class=\"has-pale-cyan-blue-background-color has-background wp-block-paragraph\">If your business turns over more than $3 million, or runs critical infrastructure, and pays a ransom or extortion demand, you have 72 hours to report it to the Government. This guide covers who must report, what counts as a payment, what the report must contain and a one-page timeline to plan around.<\/p>\n\n\n\n<div class=\"wp-block-group has-background\" style=\"background-color:#f4f6f8;padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<p class=\"wp-block-paragraph\"><strong>Related guides<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><a href=\"https:\/\/catharsis.net.au\/blog\/notifiable-data-breach-scheme\/\" target=\"_blank\" rel=\"noreferrer noopener\">Is this data breach notifiable? How the NDB scheme works<\/a><\/li>\n\n\n<li><a href=\"https:\/\/catharsis.net.au\/blog\/automated-decision-making-privacy-policy\/\" target=\"_blank\" rel=\"noreferrer noopener\">Automated decisions: what your privacy policy must say by 10 Dec<\/a><\/li>\n\n\n<li><a href=\"https:\/\/catharsis.net.au\/blog\/what-is-internal-external-penetration-testing\/\" target=\"_blank\" rel=\"noreferrer noopener\">What is Internal &amp; External Penetration Testing?<\/a><\/li>\n\n<\/ul>\n\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-group has-background\" style=\"background-color:#f4f6f8;padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<h3 class=\"wp-block-heading\">TL;DR<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>If your business is a &quot;reporting business entity&quot; and makes (or learns someone made on its behalf) a ransomware or cyber extortion payment, it must report it within <strong>72 hours<\/strong> under section 27 of the Cyber Security Act 2024.<\/li>\n\n\n<li>You&#8217;re a reporting business entity if you carry on business in Australia with annual turnover for the previous financial year above <strong>A$3 million<\/strong> (and aren&#8217;t a Commonwealth or State body), or if you&#8217;re a responsible entity for a critical infrastructure asset covered by Part 2B of the SOCI Act, whatever your turnover.<\/li>\n\n\n<li>A demand you don&#8217;t pay doesn&#8217;t trigger the mandatory report. Payments include non-monetary benefits and payments made for you by someone else.<\/li>\n\n\n<li>The report goes through the ransomware payment reporting form on cyber.gov.au. Failing to report is a civil penalty provision: 60 penalty units, and up to five times that for a company.<\/li>\n\n\n<li>Report information has legal protections: limited permitted uses, and it is generally not admissible against you in other proceedings.<\/li>\n\n<\/ul>\n\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-group has-background\" style=\"background-color:#f4f6f8;padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<h3 class=\"wp-block-heading\">In this post<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><a href=\"#what-does-the-law-actually-require\">What does the law actually require?<\/a><\/li>\n\n\n<li><a href=\"#does-this-apply-to-us\">Does this apply to us?<\/a><\/li>\n\n\n<li><a href=\"#what-must-the-report-contain\">What must the report contain?<\/a><\/li>\n\n\n<li><a href=\"#how-do-you-report\">How do you report?<\/a><\/li>\n\n\n<li><a href=\"#what-happens-if-you-don-t-report\">What happens if you don&#8217;t report?<\/a><\/li>\n\n\n<li><a href=\"#is-paying-a-ransom-legal-and-is-the-report-safe-to-make\">Is paying a ransom legal, and is the report safe to make?<\/a><\/li>\n\n\n<li><a href=\"#what-other-reports-might-the-same-incident-trigger\">What other reports might the same incident trigger?<\/a><\/li>\n\n\n<li><a href=\"#what-is-the-cyber-incident-review-board\">What is the Cyber Incident Review Board?<\/a><\/li>\n\n\n<li><a href=\"#one-page-response-timeline\">One-page response timeline<\/a><\/li>\n\n\n<li><a href=\"#key-takeaways\">Key takeaways<\/a><\/li>\n\n\n<li><a href=\"#sources\">Sources<\/a><\/li>\n\n<\/ul>\n\n<\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">General information, not legal advice. Get legal advice for your own situation, ideally before any payment is made.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-does-the-law-actually-require\">What does the law actually require?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Part 3 of the Cyber Security Act 2024 creates the obligation. It commenced in late May 2025: the Federal Register lists 29 May 2025, and the Department of Home Affairs, which administers the Act, says reporting has been active since 30 May 2025.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Section 27(1) is the core rule: the reporting business entity must give the designated Commonwealth body a ransomware payment report &quot;within 72 hours of making the ransomware payment or becoming aware that the ransomware payment has been made (whichever is applicable)&quot;.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Section 26 sets out when Part 3 applies. In plain English, all five must be true:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>A cyber security incident has occurred, is occurring or is imminent.<\/li>\n\n\n<li>It has had, is having, or could reasonably be expected to have a direct or indirect impact on your business.<\/li>\n\n\n<li>Someone (the &quot;extorting entity&quot;) makes a demand of you, or of anyone else, to benefit from the incident or its impact on you.<\/li>\n\n\n<li>You provide a payment or benefit to the extorting entity, or you&#8217;re aware someone else provided one on your behalf.<\/li>\n\n\n<li>The payment is directly related to the demand.<\/li>\n\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">The report goes to a &quot;designated Commonwealth body&quot;. Unless rules name a different one, section 8 makes that the Department of Home Affairs and the Australian Signals Directorate (ASD). In practice you file through ASD&#8217;s form on cyber.gov.au. Home Affairs monitors compliance; its factsheet says ASD &quot;does not serve as a regulator&quot;.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"does-this-apply-to-us\">Does this apply to us?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Work through this checklist. If every box in section A is ticked, plan on the assumption that you must report.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A. Are we a reporting business entity?<\/strong> (tick one)<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><input type=\"checkbox\" disabled=\"\" \/> We carry on a business in Australia, our annual turnover for the previous financial year exceeded A$3 million, and we are not a Commonwealth body or State body; <strong>or<\/strong><\/li>\n\n\n<li><input type=\"checkbox\" disabled=\"\" \/> We are the responsible entity for a critical infrastructure asset to which Part 2B of the Security of Critical Infrastructure Act 2018 applies (turnover doesn&#8217;t matter).<\/li>\n\n\n<li><input type=\"checkbox\" disabled=\"\" \/> If we only traded for part of last financial year: we&#8217;ve applied the part-year formula in section 6 of the Rules (A$3 million \u00d7 days traded \u00f7 days in that financial year). Home Affairs&#8217; example: a business that traded 73 days has a threshold of A$600,000.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Notes: Home Affairs says not-for-profit organisations &quot;are not explicitly exempt&quot;. The Act&#8217;s test is turnover that <em>exceeds<\/em> the threshold; the cyber.gov.au form and the Home Affairs factsheet describe it as A$3 million &quot;or more&quot;. If you&#8217;re close to the line, treat yourself as covered and ask your lawyer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>B. Has a payment been made?<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><input type=\"checkbox\" disabled=\"\" \/> We paid, or agreed to give, money, cryptocurrency, goods, services or any other benefit to the extorting entity in response to the demand. (Home Affairs says non-monetary benefits count, such as gifts or services.)<\/li>\n\n\n<li><input type=\"checkbox\" disabled=\"\" \/> Someone paid on our behalf: a parent company, an overseas office, an insurer, a negotiator or another third party. The 72 hours then runs from when we became aware.<\/li>\n\n\n<li><input type=\"checkbox\" disabled=\"\" \/> The incident is a cyber incident, not a physical extortion threat or a scam. (Home Affairs says physical extortion and scams aren&#8217;t subject to the mandatory report; scams go to Scamwatch.)<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>C. When doesn&#8217;t it apply?<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>A demand was made but <strong>no payment<\/strong> was made: no mandatory report. Voluntary reporting through cyber.gov.au is encouraged.<\/li>\n\n\n<li>A supplier or overseas related company paid its own ransom and your systems weren&#8217;t affected and nothing was paid for you: Home Affairs&#8217; second scenario says you are not required to report.<\/li>\n\n\n<li>You&#8217;re under the turnover threshold and not a critical infrastructure responsible entity: no mandatory ransomware payment report, but other reporting obligations (below) can still apply.<\/li>\n\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-must-the-report-contain\">What must the report contain?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Section 27(2) of the Act and section 7 of the Cyber Security (Ransomware Payment Reporting) Rules 2025 set the contents. You must include what you know, or can find out by reasonable search or enquiry, at the time of the report:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Who paid:<\/strong> contact and business details of the entity that made the payment, including ABN, and of the reporting business entity if a third party paid.<\/li>\n\n\n<li><strong>The incident:<\/strong> when it happened or is estimated to have happened, when you became aware of it, its impact on you and on your customers, the ransomware or malware variant (if any), and any vulnerabilities exploited.<\/li>\n\n\n<li><strong>The demand:<\/strong> the amount or quantum demanded (including non-monetary benefits) and the payment method demanded.<\/li>\n\n\n<li><strong>The payment:<\/strong> what was actually given and how.<\/li>\n\n\n<li><strong>Communications:<\/strong> the nature and timing of communications with the extorting entity, a brief description of them, and any pre-payment negotiations.<\/li>\n\n\n<li><strong>Anything else<\/strong> that could help a Commonwealth or State body respond to, mitigate or resolve the incident (optional).<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Check:<\/strong> if you use a negotiator or incident response firm, agree in writing who will capture the communications log, wallet addresses and timeline, and who will file the report. The obligation stays with you even when someone else pays.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-do-you-report\">How do you report?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use the <a href=\"https:\/\/www.cyber.gov.au\/ransomware-payment-and-cyber-extortion-payment-reporting\" target=\"_blank\" rel=\"noreferrer noopener\">Ransomware payment and cyber extortion payment reporting<\/a> form on cyber.gov.au (also reachable from &quot;Submit a report&quot;). A third party can submit on your behalf, but the form then needs details of both the reporting entity and the entity it is reporting for.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After submission you get a unique reference number. Home Affairs says a copy of the report won&#8217;t be provided, so save your own copy of everything you enter before you submit, and record the reference number in your incident log.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Check:<\/strong> someone in your organisation other than the IT lead knows where the form is and has authority to file. The person who normally would might be the one locked out.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-happens-if-you-don-t-report\">What happens if you don&#8217;t report?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Failing to report as required is a civil penalty provision carrying <strong>60 penalty units<\/strong>. The Commonwealth penalty unit has been A$364 since 1 July 2026 (it was A$330 before that), so 60 units is A$21,840 for a contravention from that date. The Act enforces this through the Regulatory Powers (Standard Provisions) Act 2014, under which a court can order a body corporate to pay up to five times the listed amount: 300 units, or A$109,200. These are maximums; a court sets the actual penalty.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Home Affairs is phasing in enforcement:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\">\n<thead>\n<tr>\n<th>Phase<\/th>\n<th>Dates<\/th>\n<th>Approach<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Phase 1: Education first<\/td>\n<td>30 May 2025 to 31 December 2025<\/td>\n<td>Regulatory action aimed only at egregious non-compliance<\/td>\n<\/tr>\n<tr>\n<td>Phase 2: Compliance and education<\/td>\n<td>From 1 January 2026<\/td>\n<td>&quot;A more active regulatory focus&quot;<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">We are in Phase 2 now.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"is-paying-a-ransom-legal-and-is-the-report-safe-to-make\">Is paying a ransom legal, and is the report safe to make?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Paying a ransom is not generally prohibited in Australia, but Home Affairs says the Government &quot;strongly discourages&quot; it: payment doesn&#8217;t guarantee recovery, doesn&#8217;t stop the data being published or sold, and can invite further attacks. Some payments can break other laws, in particular payments to sanctioned people or entities (check the DFAT sanctions list) and obligations under anti-money laundering and counter-terrorism financing law.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Act protects what you report:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Limited permitted uses (sections 29 and 30).<\/strong> Report information may only be used for listed purposes, such as helping you respond, the functions of intelligence agencies, and advising Ministers. It must not be used to investigate or enforce other civil or regulatory contraventions by you, other than Part 3 itself or criminal offences.<\/li>\n\n\n<li><strong>Not admissible against you (section 32)<\/strong> in most criminal, civil penalty, civil and tribunal proceedings, with exceptions such as false or misleading information, obstruction, Part 3 penalties, Royal Commissions and coronial inquiries.<\/li>\n\n\n<li><strong>Legal professional privilege (section 31)<\/strong> isn&#8217;t otherwise affected by making the report.<\/li>\n\n\n<li><strong>Good faith (section 28).<\/strong> You aren&#8217;t liable in damages for acts done in good faith in complying with section 27.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Separately, you can voluntarily share incident information with the National Cyber Security Coordinator under Part 4, which has its own &quot;limited use&quot; protections. Home Affairs is clear that doing so <strong>does not<\/strong> meet the section 27 ransomware reporting obligation.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-other-reports-might-the-same-incident-trigger\">What other reports might the same incident trigger?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A ransomware report is rarely the only one. Typical companions:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Notifiable Data Breaches (OAIC).<\/strong> If personal information was accessed or stolen and serious harm is likely, you may have to notify the OAIC and affected people. See our guide: <a href=\"https:\/\/catharsis.net.au\/blog\/notifiable-data-breach-scheme\/\" target=\"_blank\" rel=\"noreferrer noopener\">Is this data breach notifiable?<\/a><\/li>\n\n\n<li><strong>Critical infrastructure incident reporting<\/strong> under the SOCI Act, if you&#8217;re a responsible entity.<\/li>\n\n\n<li><strong>Sector regulators and contracts:<\/strong> your insurer, financial services or health regulators, and government clients often have their own notification clauses.<\/li>\n\n\n<li><strong>ASD incident report:<\/strong> you can report the incident itself to ASD through cyber.gov.au (&quot;Submit a report&quot;) whether or not you pay.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">cyber.gov.au also hosts a &quot;Single Reporting Portal&quot; page that lists Commonwealth reporting requirements a cyber incident can trigger, by industry. It is a list, not a single form.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-is-the-cyber-incident-review-board\">What is the Cyber Incident Review Board?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Part 5 of the Act creates the Cyber Incident Review Board, which the Minister for Home Affairs announced as established on 4 May 2026. It conducts no-fault, post-incident reviews of significant incidents and makes recommendations to government and industry. Under section 46 a review can be referred by the Minister, the National Cyber Security Coordinator, a Board member or an impacted entity, and can only start after the incident and the immediate response have ended. The incident must meet criteria such as serious prejudice to Australia&#8217;s social or economic stability, defence or national security, novel or complex methods, or serious concern to the Australian people. The Act says reviews are not to apportion blame or determine liability.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For most businesses the Board won&#8217;t come knocking. It is still worth knowing that a well-kept incident log is what any review, insurer or regulator will ask for first.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"one-page-response-timeline\">One-page response timeline<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use this as a planning aid alongside your incident response plan. It isn&#8217;t legal advice, and the legal clock only starts when a payment is made or you become aware of one.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\">\n<thead>\n<tr>\n<th>When<\/th>\n<th>What to do<\/th>\n<th>Owner (fill in)<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Discovery<\/strong><\/td>\n<td>Isolate affected systems, preserve evidence (don&#8217;t wipe or rebuild yet), start an incident log with times, actions and who did them. Report the incident to ASD through cyber.gov.au. Call your insurer&#8217;s incident line if you have cyber cover.<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td><strong>First hours<\/strong><\/td>\n<td>Engage incident response and legal advice. Work out what data was accessed or stolen; this drives the NDB assessment. Check backups are intact and offline. Confirm whether you&#8217;re a reporting business entity using the checklist above.<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td><strong>Before any payment decision<\/strong><\/td>\n<td>Board or owner decision recorded in writing. Sanctions check on the extorting entity and wallet. Agree who negotiates, who logs all communications, and who files the report. Pre-fill the cyber.gov.au form fields you already know.<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td><strong>Payment made: hour 0<\/strong><\/td>\n<td>Record exact time, amount or benefit, method and wallet or account details. The 72-hour clock starts now (or when you become aware a payment was made for you).<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td><strong>Within 24 hours of payment<\/strong><\/td>\n<td>Collect the remaining report contents: variant, vulnerabilities exploited, impact on you and customers, communications summary.<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td><strong>Within 72 hours of payment<\/strong><\/td>\n<td>Submit the ransomware payment report on cyber.gov.au. Save your copy and the reference number.<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td><strong>In parallel<\/strong><\/td>\n<td>Run the NDB assessment (30-day limit for a suspected breach; notify as soon as practicable once you believe it&#8217;s eligible). Check SOCI, sector and contractual notification duties.<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td><strong>After recovery<\/strong><\/td>\n<td>Post-incident review: root cause, what slowed you down, which controls would have prevented it. Update the incident response plan and run a tabletop exercise on it.<\/td>\n<td><\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<div class=\"wp-block-group has-pale-cyan-blue-background-color has-background\" style=\"padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px;margin-top:32px;margin-bottom:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<p class=\"wp-block-paragraph\"><strong>Would your team know what to do in the first hour?<\/strong> We help you write and rehearse an incident response plan that fits your organisation, so a bad day stays a bad day.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/catharsis.net.au\/managed-security\/?utm_source=blog&amp;utm_medium=article&amp;utm_campaign=value-guides&amp;utm_content=ransomware-payment-reporting-australia-managed-security\" target=\"_blank\" rel=\"noreferrer noopener\">Talk about incident response<\/a><\/div>\n\n<\/div>\n\n<\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The most reliable way to keep this law theoretical is to never be in a position where paying looks like the only option: tested offline backups, multi-factor authentication everywhere, fast patching of internet-facing systems, and monitoring that spots intruders before encryption starts. Our <a href=\"https:\/\/catharsis.net.au\/managed-security\/\" target=\"_blank\" rel=\"noreferrer noopener\">managed security service<\/a> and <a href=\"https:\/\/catharsis.net.au\/pentesting-services\/\" target=\"_blank\" rel=\"noreferrer noopener\">penetration testing<\/a> are built around those basics.<\/p>\n\n\n\n<div class=\"wp-block-group has-pale-cyan-blue-background-color has-background\" style=\"padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px;margin-top:32px;margin-bottom:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<p class=\"wp-block-paragraph\"><strong>Want someone watching for threats?<\/strong> Our managed security monitors and protects your endpoints, email and Microsoft 365, under a service level agreed with you in writing.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/catharsis.net.au\/managed-security\/?utm_source=blog&amp;utm_medium=article&amp;utm_campaign=value-guides&amp;utm_content=ransomware-payment-reporting-australia-managed-security\" target=\"_blank\" rel=\"noreferrer noopener\">See managed security<\/a><\/div>\n\n<\/div>\n\n<\/div><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"key-takeaways\">Key takeaways<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Businesses with turnover above A$3 million, and critical infrastructure responsible entities, must report ransomware or extortion payments within 72 hours.<\/li>\n\n\n<li>The clock starts when you pay or become aware a payment was made for you; a demand alone isn&#8217;t reportable (but can still be reported voluntarily).<\/li>\n\n\n<li>The report needs details of the incident, the demand, the payment and your communications with the attacker, so log them from the first minute.<\/li>\n\n\n<li>Failing to report attracts up to 60 penalty units (A$21,840 from 1 July 2026), or up to five times that for a body corporate, and Home Affairs has moved past its education-first phase.<\/li>\n\n\n<li>Report information has strong use limits and is generally inadmissible against you, but sharing with the National Cyber Security Coordinator isn&#8217;t a substitute for the report.<\/li>\n\n\n<li>Check the other obligations the same incident triggers, especially the Notifiable Data Breaches scheme.<\/li>\n\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"sources\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><a href=\"https:\/\/www.legislation.gov.au\/C2024A00098\/latest\/text\" target=\"_blank\" rel=\"noreferrer noopener\">Cyber Security Act 2024 (No. 98, 2024), Parts 3 and 5<\/a>, Federal Register of Legislation<\/li>\n\n\n<li><a href=\"https:\/\/www.legislation.gov.au\/F2025L00278\/asmade\/text\" target=\"_blank\" rel=\"noreferrer noopener\">Cyber Security (Ransomware Payment Reporting) Rules 2025, sections 6 and 7<\/a>, Federal Register of Legislation<\/li>\n\n\n<li><a href=\"https:\/\/www.homeaffairs.gov.au\/cyber-security-subsite\/files\/factsheet-ransomware-payment-reporting.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Factsheet: Mandatory ransomware and cyber extortion payment reporting<\/a>, Department of Home Affairs<\/li>\n\n\n<li><a href=\"https:\/\/www.cyber.gov.au\/ransomware-payment-and-cyber-extortion-payment-reporting\" target=\"_blank\" rel=\"noreferrer noopener\">Ransomware payment and cyber extortion payment reporting form<\/a>, cyber.gov.au<\/li>\n\n\n<li><a href=\"https:\/\/www.cyber.gov.au\/single-reporting-portal\" target=\"_blank\" rel=\"noreferrer noopener\">Single Reporting Portal<\/a>, cyber.gov.au<\/li>\n\n\n<li><a href=\"https:\/\/www.legislation.gov.au\/C2014A00093\/latest\/text\" target=\"_blank\" rel=\"noreferrer noopener\">Regulatory Powers (Standard Provisions) Act 2014, section 82<\/a>, Federal Register of Legislation<\/li>\n\n\n<li><a href=\"https:\/\/www.legislation.gov.au\/F2026N00424\/asmade\/2026-06-16\/text\/original\/pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Crimes (Amount of a Penalty Unit) Instrument 2026<\/a>, Federal Register of Legislation, and <a href=\"https:\/\/www.afsa.gov.au\/professionals\/resource-hub\/penalty-units\" target=\"_blank\" rel=\"noreferrer noopener\">Penalty units<\/a>, Australian Financial Security Authority<\/li>\n\n\n<li><a href=\"https:\/\/minister.homeaffairs.gov.au\/TonyBurke\/Pages\/cyber-incident-review-board-established.aspx\" target=\"_blank\" rel=\"noreferrer noopener\">Cyber Incident Review Board established<\/a>, Minister for Home Affairs, 4 May 2026<\/li>\n\n<\/ul>\n\n\n\n<div class=\"wp-block-group has-light-green-cyan-background-color has-background\" style=\"padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px;margin-top:40px;margin-bottom:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<h2 class=\"wp-block-heading\">Want a second pair of eyes?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Catharsis Cyber Security is a Sydney cyber security company, certified to ISO\/IEC 27001:2022. We help organisations protect, test and run their technology, and explain it in plain English.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/catharsis.net.au\/contact-us\/?type=contact&amp;service=consult&amp;utm_source=blog&amp;utm_medium=article&amp;utm_campaign=value-guides&amp;utm_content=ransomware-payment-reporting-australia-contact\" target=\"_blank\" rel=\"noreferrer noopener\">Talk to us<\/a><\/div>\n\n\n<div class=\"wp-block-button is-style-outline is-style-outline--1\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/catharsis.net.au\/contact-us\/?type=contact&amp;service=security-health-check&amp;utm_source=blog&amp;utm_medium=article&amp;utm_campaign=value-guides&amp;utm_content=ransomware-payment-reporting-australia-end-health-check\" target=\"_blank\" rel=\"noreferrer noopener\">Free security health check<\/a><\/div>\n\n<\/div>\n\n<\/div><\/div>\n\n\n\n<style>pre.wp-block-code{max-width:100%;overflow-x:auto}pre.wp-block-code code{white-space:pre}.wp-block-list a,.wp-block-table a{overflow-wrap:anywhere;word-break:break-word}<\/style>\n","protected":false},"excerpt":{"rendered":"<p>If your business turns over more than $3 million, or runs critical infrastructure, and pays a ransom or extortion demand, you have 72 hours to report it to the Government. This guide covers who must report, what counts as a payment, what the report must contain and a one-page timeline to plan around.<\/p>\n","protected":false},"author":4,"featured_media":1263,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[156,240,239,175,238,241],"class_list":["post-1264","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-security-explained","tag-asd","tag-cyber-extortion","tag-cyber-security-act-2024","tag-incident-response","tag-ransomware","tag-reporting-obligations"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Paid a ransom? Australia&#039;s 72-hour reporting rule explained - Catharsis | Blog<\/title>\n<meta name=\"description\" content=\"Paid a ransom? Under the Cyber Security Act 2024 you may have 72 hours to report it. Who must report, what to include, penalties and a response timeline.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Paid a ransom? Australia&#039;s 72-hour reporting rule explained - Catharsis | Blog\" \/>\n<meta property=\"og:description\" content=\"Paid a ransom? Under the Cyber Security Act 2024 you may have 72 hours to report it. Who must report, what to include, penalties and a response timeline.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/\" \/>\n<meta property=\"og:site_name\" content=\"Catharsis | Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-12T00:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-03T10:47:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/ransomware-payment-reporting-australia.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Catharsis\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Catharsis\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/ransomware-payment-reporting-australia\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/ransomware-payment-reporting-australia\\\/\"},\"author\":{\"name\":\"Catharsis\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#\\\/schema\\\/person\\\/ab309c676ceb9762b5c09091d50f4074\"},\"headline\":\"Paid a ransom? Australia&#8217;s 72-hour reporting rule explained\",\"datePublished\":\"2026-08-12T00:00:00+00:00\",\"dateModified\":\"2026-11-03T10:47:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/ransomware-payment-reporting-australia\\\/\"},\"wordCount\":2623,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/ransomware-payment-reporting-australia\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/ransomware-payment-reporting-australia.jpg\",\"keywords\":[\"ASD\",\"cyber extortion\",\"Cyber Security Act 2024\",\"incident response\",\"ransomware\",\"reporting obligations\"],\"articleSection\":[\"Cyber Security Explained\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/ransomware-payment-reporting-australia\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/ransomware-payment-reporting-australia\\\/\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/ransomware-payment-reporting-australia\\\/\",\"name\":\"Paid a ransom? Australia's 72-hour reporting rule explained - Catharsis | Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/ransomware-payment-reporting-australia\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/ransomware-payment-reporting-australia\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/ransomware-payment-reporting-australia.jpg\",\"datePublished\":\"2026-08-12T00:00:00+00:00\",\"dateModified\":\"2026-11-03T10:47:12+00:00\",\"description\":\"Paid a ransom? Under the Cyber Security Act 2024 you may have 72 hours to report it. Who must report, what to include, penalties and a response timeline.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/ransomware-payment-reporting-australia\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/ransomware-payment-reporting-australia\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/ransomware-payment-reporting-australia\\\/#primaryimage\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/ransomware-payment-reporting-australia.jpg\",\"contentUrl\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/ransomware-payment-reporting-australia.jpg\",\"width\":1280,\"height\":720,\"caption\":\"Paid a ransom? Australia's 72-hour reporting rule explained\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/ransomware-payment-reporting-australia\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Paid a ransom? Australia&#8217;s 72-hour reporting rule explained\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/\",\"name\":\"Catharsis | Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#organization\",\"name\":\"Catharsis | Blog\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/01\\\/catharsis_au.jpg\",\"contentUrl\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/01\\\/catharsis_au.jpg\",\"width\":215,\"height\":60,\"caption\":\"Catharsis | Blog\"},\"image\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#\\\/schema\\\/person\\\/ab309c676ceb9762b5c09091d50f4074\",\"name\":\"Catharsis\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e27fcf8abb5a2806de5f16ab76102b4c22bda3fbd37a2fa8dc934e8d725f4bad?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e27fcf8abb5a2806de5f16ab76102b4c22bda3fbd37a2fa8dc934e8d725f4bad?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e27fcf8abb5a2806de5f16ab76102b4c22bda3fbd37a2fa8dc934e8d725f4bad?s=96&d=mm&r=g\",\"caption\":\"Catharsis\"},\"description\":\"Catharsis Cyber Security is a Sydney cyber security company, certified to ISO\\\/IEC 27001:2022. We help organisations protect, test and run their technology: managed security, penetration testing, security-first managed IT, secure AI and secure development.\",\"sameAs\":[\"https:\\\/\\\/catharsis.net.au\\\/\"],\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/author\\\/catharsis-team\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Paid a ransom? Australia's 72-hour reporting rule explained - Catharsis | Blog","description":"Paid a ransom? Under the Cyber Security Act 2024 you may have 72 hours to report it. Who must report, what to include, penalties and a response timeline.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/","og_locale":"en_US","og_type":"article","og_title":"Paid a ransom? Australia's 72-hour reporting rule explained - Catharsis | Blog","og_description":"Paid a ransom? Under the Cyber Security Act 2024 you may have 72 hours to report it. Who must report, what to include, penalties and a response timeline.","og_url":"https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/","og_site_name":"Catharsis | Blog","article_published_time":"2026-08-12T00:00:00+00:00","article_modified_time":"2026-11-03T10:47:12+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/ransomware-payment-reporting-australia.jpg","type":"image\/jpeg"}],"author":"Catharsis","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Catharsis","Est. reading time":"13 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/#article","isPartOf":{"@id":"https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/"},"author":{"name":"Catharsis","@id":"https:\/\/catharsis.net.au\/blog\/#\/schema\/person\/ab309c676ceb9762b5c09091d50f4074"},"headline":"Paid a ransom? Australia&#8217;s 72-hour reporting rule explained","datePublished":"2026-08-12T00:00:00+00:00","dateModified":"2026-11-03T10:47:12+00:00","mainEntityOfPage":{"@id":"https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/"},"wordCount":2623,"commentCount":0,"publisher":{"@id":"https:\/\/catharsis.net.au\/blog\/#organization"},"image":{"@id":"https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/#primaryimage"},"thumbnailUrl":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/ransomware-payment-reporting-australia.jpg","keywords":["ASD","cyber extortion","Cyber Security Act 2024","incident response","ransomware","reporting obligations"],"articleSection":["Cyber Security Explained"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/","url":"https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/","name":"Paid a ransom? Australia's 72-hour reporting rule explained - Catharsis | Blog","isPartOf":{"@id":"https:\/\/catharsis.net.au\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/#primaryimage"},"image":{"@id":"https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/#primaryimage"},"thumbnailUrl":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/ransomware-payment-reporting-australia.jpg","datePublished":"2026-08-12T00:00:00+00:00","dateModified":"2026-11-03T10:47:12+00:00","description":"Paid a ransom? Under the Cyber Security Act 2024 you may have 72 hours to report it. Who must report, what to include, penalties and a response timeline.","breadcrumb":{"@id":"https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/#primaryimage","url":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/ransomware-payment-reporting-australia.jpg","contentUrl":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/ransomware-payment-reporting-australia.jpg","width":1280,"height":720,"caption":"Paid a ransom? Australia's 72-hour reporting rule explained"},{"@type":"BreadcrumbList","@id":"https:\/\/catharsis.net.au\/blog\/ransomware-payment-reporting-australia\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/catharsis.net.au\/blog\/"},{"@type":"ListItem","position":2,"name":"Paid a ransom? Australia&#8217;s 72-hour reporting rule explained"}]},{"@type":"WebSite","@id":"https:\/\/catharsis.net.au\/blog\/#website","url":"https:\/\/catharsis.net.au\/blog\/","name":"Catharsis | Blog","description":"","publisher":{"@id":"https:\/\/catharsis.net.au\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/catharsis.net.au\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/catharsis.net.au\/blog\/#organization","name":"Catharsis | Blog","url":"https:\/\/catharsis.net.au\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/catharsis.net.au\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2019\/01\/catharsis_au.jpg","contentUrl":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2019\/01\/catharsis_au.jpg","width":215,"height":60,"caption":"Catharsis | Blog"},"image":{"@id":"https:\/\/catharsis.net.au\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/catharsis.net.au\/blog\/#\/schema\/person\/ab309c676ceb9762b5c09091d50f4074","name":"Catharsis","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/e27fcf8abb5a2806de5f16ab76102b4c22bda3fbd37a2fa8dc934e8d725f4bad?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/e27fcf8abb5a2806de5f16ab76102b4c22bda3fbd37a2fa8dc934e8d725f4bad?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e27fcf8abb5a2806de5f16ab76102b4c22bda3fbd37a2fa8dc934e8d725f4bad?s=96&d=mm&r=g","caption":"Catharsis"},"description":"Catharsis Cyber Security is a Sydney cyber security company, certified to ISO\/IEC 27001:2022. We help organisations protect, test and run their technology: managed security, penetration testing, security-first managed IT, secure AI and secure development.","sameAs":["https:\/\/catharsis.net.au\/"],"url":"https:\/\/catharsis.net.au\/blog\/author\/catharsis-team\/"}]}},"_links":{"self":[{"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/posts\/1264","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/comments?post=1264"}],"version-history":[{"count":1,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/posts\/1264\/revisions"}],"predecessor-version":[{"id":1292,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/posts\/1264\/revisions\/1292"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/media\/1263"}],"wp:attachment":[{"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/media?parent=1264"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/categories?post=1264"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/tags?post=1264"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}