Ransomware payment reporting in Australia: the 72-hour rule

According to the Home Affairs ransomware payment reporting factsheet, a business with annual turnover of AUD 3 million or more must report a ransomware or cyber extortion payment to ASD within 72 hours. The obligation comes from the Cyber Security Act 2024 and its Rules, which started on 30 May 2025.

Key takeaways

• Reporting has applied since 30 May 2025.
• The turnover threshold is AUD 3 million.
• Critical infrastructure responsible entities are also covered.
• Reports go through ASD’s ReportCyber form within 72 hours.
• Failing to report carries a civil penalty of 60 penalty units.

Who must report

Part 3 of the Act calls them reporting business entities. The factsheet and the ReportCyber form describe two groups:

• Businesses in Australia with turnover of AUD 3 million or more last financial year.
• Responsible entities for critical infrastructure assets under Part 2B of the SOCI Act.

The Rules include a formula for a business that traded for only part of the previous financial year.

When the clock starts

Section 27 of the Act gives 72 hours from making the payment, or from becoming aware that a payment was made on your behalf. A payment by an insurer or an incident response firm counts, and a third party can lodge the report for you.

What the report asks for

The ReportCyber form asks for details you know or can find by reasonable search or enquiry:

• When the incident occurred and when you became aware of it.
• Its impact on your infrastructure and your customers.
• Any vulnerabilities exploited.
• The demand and the payment, monetary or not.
• Communications with the extorting entity.

The penalty

The Act sets a civil penalty of 60 penalty units for failing to report. Home Affairs said it would take an education-first approach for the first six months after the Rules began, before a more active regulatory focus.

Sorami’s view

This section is opinion. It is our advice on preparing, not a reading of the law. Get legal advice for a live incident.

The 72 hours run while you are still recovering systems, so the report details should be gathered as the incident unfolds. Name an owner in your incident plan to keep the timeline, the demand and every message with the attacker.

Check your cyber insurance policy too. If the insurer can pay on your behalf, agree in advance who lodges the report and who tells you when payment happens.

What to do now

1. Confirm whether last year’s turnover reached AUD 3 million.
2. Add the ReportCyber step to your incident response plan.
3. Name who records the incident timeline and attacker messages.
4. Agree reporting duties with your insurer and response firm.

To add reporting duties to your incident plan, see our vCISO service, or contact us to discuss scope.

Related guides

• Privacy Act Tranche 2: the proposed 72-hour breach notice
• AA26-281A: the seven-nation China-linked hacking advisory
• Every Sorami article is in the guides index.

Sources

• Department of Home Affairs, Ransomware Payment Reporting Guidance (factsheet, PDF)
• Department of Home Affairs, Cyber Security Act
• ASD ReportCyber, Ransomware payment and cyber extortion payment reporting form

Facts on this page were checked against these sources on 12 October 2026. We update the page when the source changes.