Ransomware payment reporting: the 72-hour rule is in its compliance phase
A business with annual turnover of $3 million or more, or a critical infrastructure responsible entity, must report a ransomware or cyber extortion payment.
Who has to report
Part 3 of the Cyber Security Act 2024 applies to a reporting business entity: one carrying on business in Australia with annual turnover of $3 million or more in the previous financial year, or a responsible entity for a critical infrastructure asset.
Commonwealth and State bodies are excluded. A business that traded for part of the year pro-rates the threshold using the formula in the Rules.
What has to be reported, and when
The clock is 72 hours from the payment, or from the moment the business becomes aware a payment was made on its behalf. A demand that was not paid needs no mandatory report. Non-monetary benefits given to the extorting party count as a payment.
The report goes through the form on cyber.gov.au and covers the incident, its impact on the business and its customers, the demand, the payment and how it was made.
The compliance phase
Home Affairs ran an education-first phase from 30 May to 31 December 2025, pursuing regulatory action only for egregious non-compliance. Since 1 January 2026 the Department has taken a more active regulatory focus.
- Add the 72-hour report to the incident response plan as a named task with an owner
- Agree in advance who decides on any payment, and who files the report
- Confirm whether an insurer, negotiator or parent company would pay on your behalf
- Keep the facts the form asks for in the incident log from the first hour
Sources
- PrimaryDepartment of Home Affairs, Factsheet: mandatory ransomware and cyber extortion payment reportingRetrieved 25 Oct 2026
- PrimaryASD, Ransomware payment and cyber extortion payment reportingRetrieved 25 Oct 2026
