When must my business report a ransomware payment under Australian law?

Australia has introduced strict new transparency laws to combat the rising tide of cyber extortion. The Cyber Security Act 2024 (Cth) creates a clear legal obligation for businesses to report when they pay attackers.

The 72-Hour Reporting Rule

If your business decides to pay a ransom (or any form of extortion payment) in response to a cyber incident, you must notify the Australian Signals Directorate (ASD) through the Australian Cyber Security Centre (ACSC) within 72 hours of making the payment.

Does this apply to my business?

The reporting obligation applies to:

• Entities with an annual turnover exceeding $3 million.
• Critical infrastructure operators (SOCI Act entities).
• Government agencies.

What information must be reported?

You are required to provide details including:

• The nature of the incident.
• The amount paid (e.g., in cryptocurrency).
• The reason for making the payment.
• Communication details with the threat actor.

Legal and Insurance Implications

Sanctions Compliance

Making a payment to a sanctioned entity is illegal under Australian law. A lawyer can help conduct “sanctions checking” before any payment is authorized to ensure you don’t face criminal prosecution for inadvertently funding prohibited groups.

Insurance Coverage

Most cyber insurance policies require you to notify the insurer before making a payment. If you pay without their consent, or fail to report the payment as required by law, your insurance claim will likely be denied.

Privilege and Confidentiality

While the report to the ASD is mandatory, you should involve legal counsel early to ensure that internal investigations and communications regarding the incident are protected by legal professional privilege where possible.

Need to report a breach or payment? Read our insights on cyber insurance claim denials or Contact Bell & Senior immediately for crisis management.