Australia now puts a legal clock on ransom payments — and from January 2026 missing it costs real money, so every Melbourne business needs a plan before the day it matters.
Pay a ransom in Australia now and the law gives you 72 hours to tell the government — miss it and you risk a civil penalty of 60 penalty units, which is $21,840 at today's rate and more for a company. That is the practical upshot of the ransomware payment reporting obligation under the Cyber Security Act 2024, which commenced on 30 May 2025. For the first stretch the government took an education-first approach, but since 1 January 2026 the focus has been on enforcement. If you have not thought about what your business would do in the 72 hours after a ransom is paid, now is the time.
What does Australia's ransomware payment reporting rule require?
Under the Cyber Security Act 2024, a business with annual turnover above $3 million, or one responsible for a critical infrastructure asset, must report any ransomware or cyber extortion payment to the Australian Signals Directorate (ASD) within 72 hours of paying, or of learning someone paid on its behalf. The detail is narrower than the headlines suggest, so here is how Key IT reads the government guidance on mandatory ransomware reporting at the time of writing:
It is triggered by payment, not by the attack
The reporting duty kicks in when a ransom or extortion payment is made — by you, or by someone acting on your behalf, such as an insurer, a lawyer or an incident-response firm. The breach itself is reported separately.
The clock is 72 hours
You have 72 hours from making the payment, or from becoming aware that a payment was made on your behalf, to lodge the report with the ASD through the form on cyber.gov.au.
It applies above a turnover threshold
The legal obligation falls on businesses with annual turnover above AUD $3 million, plus responsible entities for critical infrastructure assets whatever their size. Many micro-businesses are technically out of scope — but, as below, that is not a reason to skip a plan.
The penalty is now enforceable
Failing to report carries a civil penalty of 60 penalty units. A Commonwealth penalty unit has been $364 since 1 July 2026, so that is $21,840 (it was $19,800 at the earlier $330 rate), and a court can order a company to pay up to five times that amount. The education-first period ran to 31 December 2025; the enforcement focus began in January 2026.
The Department of Home Affairs administers the rule and its compliance approach, and the detail can shift, so treat the ASD's official payment reporting guidance on cyber.gov.au as the source of truth and check it when an incident is live rather than relying on memory.
Does the 72-hour rule apply if you turn over less than $3 million?
Legally, no: if your turnover sits below $3 million and you are not responsible for a critical infrastructure asset, the reporting duty and its civil penalty do not apply to you today. That is a genuine relief — but it is the wrong thing to focus on. Two reasons. First, thresholds and scope get reviewed; a rule that captures larger businesses in 2026 has a way of widening over time. Second, and more importantly, the reporting obligation is a symptom of the real problem, not the problem itself. The problem is that a ransomware attack has reached the point where someone is seriously considering paying. By then the data is already encrypted, the business is already stopped, and the 72-hour clock is the least of your worries. Attackers do not check your turnover before they strike, which is why the idea that a business is too small to be a target is a myth.
The honest takeaway: whether or not the law compels you to report, you want a plan that means you never have to. A reporting obligation is a floor, not a strategy.
Why is the 72-hour deadline harder to meet than it sounds?
Because the clock starts in the middle of a live incident, not in a calm boardroom — systems down, staff locked out, customers calling, and a decision being made under pressure about whether to pay. That is precisely the moment when nobody wants to also be working out who reports what to whom, and within what deadline. If you have never lived through one, here is what happens during a ransomware attack, stage by stage.
This is the case for having the answers written down before anything happens. A short, practical incident response plan that names who decides, who lodges the report, where the official guidance lives, and how the clock is tracked turns a panicked scramble into a checklist. The businesses that handle this well are the ones who decided in advance, not on the day.
How do you comply with the 72-hour rule — and avoid paying a ransom at all?
The new obligation rewards two things: being prepared to report quickly, and being unlikely to ever need to. Both come down to the same security fundamentals. Here is where to put your effort:
Get the Essential 8 basics in place
The ACSC's Essential Eight — patching, application control, MFA, restricted admin rights, backups and the rest — blocks the common paths ransomware uses to get in and spread. We assess and lift your maturity through our Essential 8 work, because most ransomware exploits something the Essential Eight would have closed. New to the framework? Start with the Essential Eight explained in plain English.
Detect early, before encryption
Ransomware rarely encrypts the moment it lands; there is usually a window of reconnaissance and lateral movement first. Our 24/7 SOC monitoring looks for exactly those signals, so an intrusion can be caught and isolated before it becomes an encryption event — and a payment decision.
Make backups your real answer to a ransom demand
Immutable, tested, offline backups are what let a business say no to a ransom and recover instead. Untested backups are not a plan. Our disaster recovery and business continuity service exists so encrypted data is an inconvenience, not a crisis.
Decide who reports — and write it down
Name the person responsible for lodging the 72-hour report, and make sure your insurer or any third party who might pay on your behalf knows to tell you immediately, because their payment starts your clock.
Where Key IT fits
We are a Melbourne security-first managed IT and cybersecurity partner, based in Greensborough and serving north-east Melbourne and the CBD. Our engineers are security-certified, 24/7 SOC monitoring is part of how we protect clients, and we have been doing this since 2019 — with no lock-in contract. For ransomware specifically, that means we work to keep you out of the position where a payment is even on the table: hardening identity and email, patching the holes attackers use, having the SOC watch for intrusions in real time, and keeping recoverable backups. And if the worst does happen, our incident response process includes the regulatory steps — so the 72-hour clock is one we are tracking with you, not something you discover too late.
Frequently asked questions
Do I have to report a ransomware payment in Australia?
If your business has annual turnover above AUD $3 million, or is responsible for a critical infrastructure asset, yes. Under the Cyber Security Act 2024 you must report a ransomware or extortion payment to the Australian Signals Directorate (ASD) within 72 hours of the payment being made — including payments made on your behalf by an insurer or another third party. The obligation commenced on 30 May 2025, with an enforcement focus from January 2026. Businesses under the threshold are not legally compelled, but should still report and, more importantly, have a plan to avoid paying at all.
What is the penalty for not reporting within 72 hours?
Failing to report carries a civil penalty of 60 penalty units. Since 1 July 2026 a Commonwealth penalty unit is $364, so that is $21,840 (it was $19,800 at the earlier $330 rate), and a court can order a company to pay up to five times that. An education-first period ran to 31 December 2025; from January 2026 the focus moved to enforcement. Because penalty amounts and guidance can change, confirm the current figure against the official guidance when an incident is live.
Who do I report a ransomware payment to, and how?
You report it to the Australian Signals Directorate (ASD), using the online form on cyber.gov.au, within 72 hours of the payment. The Department of Home Affairs administers the rule. If an IT provider, insurer or lawyer is helping during the incident, agree up front who lodges the report so the deadline is not missed.
What information goes in a ransomware payment report?
Expect to provide your business details, what happened in the incident and its impact, the demand made, the payment itself (amount and method; a non-cash benefit also counts as a payment), and your communications with the attacker. Keeping a timeline and copies of those messages from the first hour makes the report far quicker to complete.
Is it illegal to pay a ransom in Australia?
Generally, no. Paying a ransom is not itself illegal, but paying a person or group on Australia's sanctions lists can be a serious offence, so get legal advice first. The government advises against paying, because payment does not guarantee your data back or stop it being leaked. If you do pay and the rule covers you, the 72-hour report applies.
Does the 72-hour clock start at the attack or the payment?
At the payment. The reporting obligation is triggered when a ransom or extortion payment is made, or when you become aware one was made on your behalf — not when the attack or breach is first detected. The underlying cyber incident may carry separate reporting obligations of its own.
We are a small business under $3 million turnover. Can we ignore this?
You can ignore the legal reporting duty for now, but not the risk behind it. The obligation exists because ransomware is hitting Australian businesses of every size. Whether or not the law applies to you, the goal is to never be in a position where paying a ransom is your only option — which means working backups, MFA, patching and monitoring. We would rather help you avoid the incident than help you report it.
How exposed is your business? A free cybersecurity health check gives you an Essential Eight snapshot and your top three risks.
Request the Free Check