Ransomware Payment Reporting for Australian Businesses

The rule in brief

The reporting obligation comes from the Cyber Security Act 2024. The Department of Home Affairs factsheet sets out the key points ^[1]:

• Who: businesses carrying on business in Australia with an annual turnover for the previous financial year that exceeds AUD $3 million, with a pro-rated threshold for businesses that only operated for part of that year ^[1].
• When: within 72 hours of making the payment, or of becoming aware that a payment was made on your behalf ^[1].
• To whom: the Australian Signals Directorate, using the reporting form on its website ^[1].
• Since: 30 May 2025 ^[1].
• Penalty: a civil penalty of 60 penalty units may apply for failing to make a mandatory report ^[1].

A law firm summary adds that responsible entities for critical infrastructure assets under the Security of Critical Infrastructure Act 2018 are also covered, and that the turnover threshold is set under section 26(2) of the Act ^[2].

What triggers a report

The trigger is the payment, not the attack. As the same summary puts it, the requirement to report applies only where a ransom is paid, so attempted attacks or extortion demands alone do not trigger the mandatory report ^[2]. That does not mean unpaid demands should go unreported. They are still cybercrime, and reporting them helps the Australian Signals Directorate understand what is happening.

What a report includes

The factsheet says a report covers the contact and business details of the entity that made the payment, including its ABN, along with details of the incident, the extortion demand, the payment and any communication with the extorting party ^[1]. The law firm summary notes that entities must supply information they know, or can find out by reasonable search or enquiry ^[2].

In practice, the facts gathered for a website recovery overlap heavily with this list: when the incident started, what was affected, what the demand said, and what was paid. Keeping clear notes from the first hour saves time later.

How it is being enforced

From 30 May to 31 December 2025, Home Affairs took an education-first approach, with compliance-focused enforcement from 1 January 2026 ^[1]. The factsheet also states that ASD does not serve as a regulator ^[1]. The law firm summary notes limits on how information in a mandatory report can be used, citing section 32 of the Act ^[2].

How this relates to website incidents

In our view, many WordPress hacks are not ransomware in the classic sense. The attacker often wants to use the site, to send spam, redirect visitors or skim payment details, rather than lock it. But extortion does happen to websites: a site's files or database encrypted with a demand left behind, or a threat to publish customer data taken from a shop.

When that happens, three separate questions arise:

1. Has a payment been made? If so, and the business meets the threshold, the 72-hour report applies ^[1].
2. Was personal information accessed? If so, and the business is covered by the Privacy Act, the data breach assessment and notification rules may apply ^[3].
3. Can the site be brought back without paying? That depends almost entirely on backups.

Backups are the practical defence

For a small business website, the best answer to extortion is not needing to negotiate. The WordPress hardening guide recommends regular backups of files and databases, kept as snapshots and protected, for example with encryption or read-only storage ^[4]. If those backups sit outside the hosting account and have been tested, a locked or wiped site can be restored without engaging with the attacker at all.

Our guide to backups that actually restore covers how to set that up. For reporting and support options, see getting help from ReportCyber and IDCARE.

Deciding in advance

The 72-hour window is short, and extortion tends to arrive at inconvenient times. Businesses near or above the turnover threshold benefit from deciding a few things in advance rather than in the moment:

• who has authority to decide on any payment, and who must be consulted;
• who will collect the facts the report needs, such as the demand, the amount, the payment method and the communications;
• whether your cyber insurance policy, if you have one, sets its own notification steps;
• where the reporting address and the hotline number are written down, in a place that does not depend on the affected systems.

Writing this on one page alongside your website restore guide means the right people know what to do on a bad day.

If your turnover is $3 million or less

Businesses with a turnover of $3 million or less are not required to make the mandatory payment report ^[1]. They can still report the incident to the Australian Signals Directorate through the same website, and doing so is encouraged because it helps others. The practical advice is the same at any size: keep tested backups away from the website, so that a locked or wiped site can be restored without dealing with the attacker.

Who in the business makes the call

A ransom demand puts pressure on whoever happens to see it first. That might be an office manager, a bookkeeper or the person who looks after the website. Deciding in advance who has the authority to respond takes that pressure off individual staff and stops rushed decisions.

Write down, in one short paragraph, who decides and who must be told. A workable version names:

• the owner or director who makes any decision about a demand;
• a second person who can act if the first is unreachable;
• who contacts the host, the insurer (if you have one) and any outside helper;
• who checks whether a report is required and makes it within the time allowed, if a payment is ever made.

Store this with your incident notes, somewhere that does not depend on the website or the office computers. A printed copy in a folder is perfectly fine.

The plan should also say what staff must not do: reply to the attacker, click links in the demand, or make any payment on their own. Most small businesses will never face this situation. Those that do are far better placed if the first person to see a demand knows exactly who to call and what to leave alone.

A short checklist

• Check whether your turnover for the previous financial year was more than $3 million.
• Write down who in the business would make a reporting decision, and who would submit the form.
• Keep the ASD reporting address, cyber.gov.au, somewhere staff can find it offline.
• Make sure website backups are stored away from the site and tested.