Paid a ransom? Businesses with $3 million turnover must report it within 72 hours
If your business pays a ransom after a cyber attack, and its turnover was $3 million or more last financial year, you must report the payment within 72 hours. The Department of Home Affairs has now moved past its education-first period, so it's worth knowing the rule before you ever need it.
What’s the rule?
Under the Cyber Security Act 2024, a business that makes a ransomware or cyber extortion payment, or knows one was made on its behalf, must report it to the Australian Government within 72 hours of the payment. Reports are made using the ransomware payment reporting form on the Australian Signals Directorate’s website.
The obligation started on 30 May 2025. The Department of Home Affairs ran an education-first period until 31 December 2025, taking regulatory action only for egregious non-compliance. From 1 January 2026 it moved to a more active regulatory focus.
Who does it apply to?
According to the Department of Home Affairs factsheet, you’re a “reporting business entity” if you carry on business in Australia and your annual turnover for the previous financial year was $3 million or more. It also applies to responsible entities for certain critical infrastructure assets. Not-for-profits aren’t specifically exempt.
If you’ve only been trading for part of the last financial year, the $3 million threshold is scaled down by the number of days you traded. The factsheet’s example: a business that started 73 days before the end of the financial year has a threshold of about $600,000.
What doesn’t need to be reported?
- Demands you don’t pay. The obligation applies only when a payment is made. You’re encouraged to report other cyber incidents and extortion demands voluntarily at cyber.gov.au/report.
- Scams and physical extortion threats. These aren’t covered by the mandatory reporting rule. Report scams through Scamwatch.
What happens if you don’t report?
The Act provides for a civil penalty of 60 penalty units for failing to make a required report. The factsheet also explains how information in a report can and can’t be used, including that the obligation doesn’t affect legal professional privilege.
What this means for small businesses
Most small businesses are below the $3 million threshold, but many growing businesses, professional practices and managed service provider clients are above it. If you are:
- Add the 72-hour report to your incident response plan, alongside who to call first, how to restore from backups and who can approve decisions.
- Talk to your IT provider and insurer now about who would make a payment decision and who would lodge the report. If a third party reports for you, the report must include details of both businesses.
- Make paying less likely. Tested offline backups and multi-factor authentication are the best protection against ransomware. See our guide to cyber security and backups.
For free help after a cyber attack, call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).