Ransomware payments: the 72-hour reporting obligation under the Cyber Security Act 2024

Part 3 of the Cyber Security Act 2024 has applied since 30 May 2025. It does not prohibit paying a ransom. It requires certain businesses that pay, or become aware that a payment was made on their behalf, to tell the Commonwealth within 72 hours.

For most organisations the hard part is not the form. It is making sure the people who decide whether to pay also know that the decision starts a statutory clock.

The obligation in brief

Under section 27, a reporting business entity must give a ransomware payment report to the designated Commonwealth body within 72 hours of making the ransomware payment or becoming aware that it has been made. In practice, reports are made through the ransomware payment and cyber extortion payment reporting form on the Australian Signals Directorate’s ReportCyber page at cyber.gov.au.

The Department of Home Affairs administers the Act and monitors compliance. The Australian Signals Directorate (ASD) receives reports but, as Home Affairs notes, is not a regulator and does not monitor compliance.

Who must report

An entity is a reporting business entity if, at the time the payment is made, it is either:

• carrying on a business in Australia with an annual turnover for the previous financial year that exceeds the turnover threshold, and is not a Commonwealth body, a State body or a critical infrastructure responsible entity; or
• a responsible entity for a critical infrastructure asset to which Part 2B of the Security of Critical Infrastructure Act 2018 applies, regardless of turnover.

The Cyber Security (Ransomware Payment Reporting) Rules 2025 set the threshold at $3 million. For a business carried on for only part of the previous financial year, the threshold is pro-rated by the number of days. The Act’s wording is “exceeds”, while Home Affairs’ reporting form describes turnover “equal to or exceeds $3 million”. Businesses close to the line should take advice rather than rely on the margin.

Home Affairs also notes that not-for-profit organisations are not explicitly exempt.

What triggers a report, and what does not

Part 3 applies where a cyber security incident has had, or could reasonably be expected to have, a direct or indirect impact on the reporting business entity, an extorting entity makes a demand to benefit from it, and the entity provides, or is aware another entity has provided on its behalf, a payment or benefit directly related to that demand.

Several features matter for governance:

• No payment, no report. A demand that is refused does not require a report, although Home Affairs encourages voluntary reporting of incidents to ASD.
• Benefits count. A ransomware payment includes non-monetary benefits, such as services or other things of value.
• Payments by others count. Payments made by a third party, another entity in the corporate group or an overseas office on the entity’s behalf must be reported. The reporting business entity remains responsible, and the 72 hours run from when it becomes aware.
• Overseas incidents can count. Home Affairs’ guidance states that the Act applies within and outside Australia. An incident that starts at an offshore supplier or parent can still create an obligation for the Australian entity it affects.
• Out of scope. Home Affairs states that physical extortion threats and scam-related attacks are not subject to the mandatory obligation.

What the report must contain

Section 27 and section 7 of the Rules require information, to the extent the entity knows it or can find it out by reasonable search or enquiry within the 72 hours, about:

• the contact and business details of the entity that paid, including ABN and address, and of any other entity that paid on its behalf;
• the incident: when it occurred or is estimated to have occurred, when the entity became aware of it, its impact on the entity’s infrastructure and customers, any ransomware or malware variants used, and any vulnerabilities exploited;
• the demand: the amount or nature of what was demanded and the method of payment demanded;
• the payment: what was given and how;
• communications with the extorting entity, including their timing, a brief description, and any pre-payment negotiations.

Unknown details can be reported as unknown. Home Affairs notes that a reference number is generated on submission but a copy of the report is not provided, so the entity should keep its own record of what it submitted.

How the information is protected

Part 3 contains its own information protections. A designated Commonwealth body may record, use or disclose report information only for listed purposes, such as helping the entity respond to the incident, Commonwealth and State incident response functions, advising Ministers, and the functions of intelligence agencies (section 29). It must not use the information to investigate or enforce the entity’s contravention of other Commonwealth, State or Territory laws, other than Part 3 itself or criminal offences. Similar limits apply to secondary recipients (section 30).

Reporting does not otherwise affect a claim of legal professional privilege (section 31). The information is generally not admissible against the reporting entity in criminal proceedings, civil penalty proceedings, other proceedings for breach of law or tribunal proceedings, with exceptions for false or misleading information, obstruction of Commonwealth officials, civil penalties under Part 3, coronial inquiries and Royal Commissions (section 32). An entity is also protected from damages actions for acts done in good faith in complying with the reporting obligation (section 28).

These protections are often described loosely as “limited use”. Strictly, that term belongs to Part 4 of the Act, which covers voluntary information sharing with the National Cyber Security Coordinator. Home Affairs is clear that voluntarily sharing information with the Coordinator does not satisfy the mandatory reporting obligation.

Enforcement and the end of the education-first phase

Failing to report within 72 hours can attract a civil penalty of 60 penalty units. Home Affairs implemented the obligation in two phases:

• Phase 1, 30 May to 31 December 2025: an education-first approach, with regulatory action aimed only at egregious non-compliance.
• Phase 2, from 1 January 2026: a compliance and education approach, with a more active regulatory focus.

The transition period is over. An organisation that has not yet built the obligation into its response arrangements is now exposed in a way it was not in 2025.

A separate obligation from the Notifiable Data Breaches scheme

Ransomware incidents often involve personal information. Where they do, the Privacy Act’s Notifiable Data Breaches scheme runs alongside Part 3, and the two do not substitute for each other.

Aspect	Ransomware payment report	Notifiable Data Breaches scheme
Trigger	A ransomware or cyber extortion payment is made	An eligible data breach likely to result in serious harm
Timing	Within 72 hours of payment or awareness of payment	Assess a suspected breach within 30 days; notify as soon as practicable
Recipient	Designated Commonwealth body, via ASD’s ReportCyber	OAIC and affected individuals

Home Affairs notes that paying a ransom does not guarantee the recovery of data or prevent its publication or sale. Organisations should therefore be cautious about treating a payment as remedial action that changes the outcome of an NDB assessment.

The governance questions to settle now

Ransomware reporting is primarily a decision-rights problem. Before any incident, boards and executives should be able to answer:

1. Who can authorise a payment, and under what conditions?
2. What advice is required first? Home Affairs warns that payments to sanctioned persons may breach sanctions law and that payments may engage anti-money laundering and counter-terrorism financing obligations. The Australian Government strongly discourages paying.
3. Who owns the 72-hour report, and who checks it before it is submitted?
4. How will you know if a negotiator, other third party, parent company or offshore office pays on your behalf?
5. How will the payment decision, the ransomware report and the NDB assessment be recorded so that each can be explained later to regulators, insurers and the board?

These are governance and documentation questions, not technical ones. They can and should be answered before the first demand arrives.

General information, not legal advice. Confirm how Part 3 of the Cyber Security Act 2024 applies to your organisation with your legal adviser.