Ransomware reporting now has teeth: what enforcement looks like in 2026
Australia's 72-hour ransomware payment reporting rule moved from education to enforcement in 2026. Who must report, what regulators expect, and how to prepare.
The 72-hour ransomware payment reporting rule spent its first months in "education mode". That grace period is over — from January 2026, the regulator moved to active enforcement. Here's what that changes.
Ransomware payment reporting is now actively enforced in Australia. Under the Cyber Security Act 2024, a business with turnover above $3 million that pays a ransom must report it to the Australian Signals Directorate (ASD) within 72 hours, and since 1 January 2026 the Department of Home Affairs, which regulates the scheme, has moved from education to compliance and enforcement. We covered the rule itself when it landed; this is Key IT's update on what enforcement means in practice for Melbourne businesses.
Who has to report a ransomware payment in Australia?
A business must report if it carries on business in Australia with annual turnover above $3 million (or is a responsible entity for a critical infrastructure asset), and it — or someone on its behalf — makes a ransomware payment or gives any benefit to an extorting party. Commonwealth and state government bodies are excluded. The report goes to ASD, and the 72 hours run from the moment the payment is made, or from when you learn someone paid on your behalf. Note the trigger carefully: the clock starts at payment, not at the attack, and "benefit" is broader than cash.
How do you lodge a ransomware payment report with ASD?
You lodge it online, using the ransomware payment report form on ASD's website, cyber.gov.au. Expect the form to ask for:
Who you are
your business and contact details, including your ABN, plus details of any third party that paid on your behalf.
What happened
the ransomware or cyber extortion incident and its impact on your business.
The demand and the payment
the amount and payment method the attackers asked for, and what was actually paid and how.
Your communications
what was exchanged with the extorting party, including any negotiation before payment.
You only have to include what you know, or can reasonably find out, when you report — so lodge on time with what you have rather than waiting for a complete picture.
What does ransomware reporting enforcement look like in 2026?
Enforcement means the difference between a rule and a consequence. In practice, expect:
Civil penalties for non-reporting.
Missing the 72-hour window can attract a civil penalty, which the Act sets at 60 penalty units. During 2025, Home Affairs reserved enforcement for the most serious non-compliance; from 2026, a missed report is squarely in scope.
Follow-up questions.
Reports feed ASD's national threat picture, and reported incidents can draw requests for further detail — another reason clean incident records matter.
Cross-checking.
Regulators see incidents from multiple angles — data breach notifications to the OAIC, insurance claims, public leak sites. A payment that surfaces elsewhere but was never reported is the worst position to be in.
One important protection remains: the scheme's limited-use rules mean information you report cannot be freely weaponised against you for other regulatory purposes. The design intent is honest reporting, not ambush.
What should be in your playbook before you ever need it?
The businesses that handle this well decided everything before the incident, because an attack moves fast once it starts (our stage-by-stage guide to what happens during a ransomware attack shows why). Your incident response plan should already name:
Who decides on payment
a named decision-maker plus legal advice, because paying is a legal, ethical and practical minefield (and no guarantee of recovery).
Who files the report
with the 72-hour clock, the ASD reporting step must be on the checklist, owned by someone, not assumed.
What gets recorded
timeline, communications, amounts, wallet details. If a payment happens under duress at 2am, the record is what protects you later.
How you avoid the whole question
immutable backups and tested recovery so payment is never the only path back, plus the Essential Eight controls insurers and clients now check to keep attackers out in the first place.
Frequently asked questions
Is the 72-hour ransomware reporting rule being enforced yet?
Yes. After an education-first phase from 30 May to 31 December 2025, Home Affairs has taken a full compliance and enforcement approach since 1 January 2026. A business above the $3 million threshold that misses the 72-hour deadline risks a civil penalty of 60 penalty units under the Act.
We're under $3 million turnover — does any of this apply?
The mandatory reporting obligation does not, but voluntary reporting to ASD is encouraged and genuinely useful. Privacy Act breach notification can still apply below $3 million, too: health service providers, such as medical and dental practices, are covered whatever their turnover.
Does reporting a payment get us in trouble for paying?
Paying a ransom is not illegal in most circumstances (sanctions being the exception to check with lawyers), and the scheme's limited-use protections exist so reporting is not self-incrimination. Not reporting is what now carries the penalty.
What if our IT provider or insurer pays on our behalf?
The obligation still lands on your business — payments made on your behalf count. Make sure any provider or insurer involved in a negotiation knows the reporting step is non-negotiable and time-boxed.
Do we have to report if we refused to pay the ransom?
No. The mandatory report is triggered by a payment or other benefit, not by the demand or the attack. Reporting the incident to ASD through ReportCyber is still worthwhile, and any Privacy Act data breach duties apply whether or not you paid.
Does a ransomware payment report replace our OAIC data breach notification?
No. The ASD report sits alongside your other obligations rather than replacing them. If you are covered by the Privacy Act and the breach is likely to cause serious harm, the Notifiable Data Breaches scheme still requires you to notify the OAIC and the affected people. Critical infrastructure entities keep their separate incident reporting duties.
Isn't the best strategy just never paying?
Never needing to pay is the strategy. That means closing common entry points, such as the firewall VPNs abused in the Akira ransomware campaign, and building backup, detection and response capability before the incident — which is precisely what our 24/7 SOC monitoring and recovery services exist for.
Pressure-test your plan
If you cannot name your payment decision-maker and your report-filer right now, your plan has a gap. We build and rehearse these playbooks with clients — a one-hour tabletop exercise now beats a 2am scramble later.
Related services & guides
More insights
Ransomware hits Australian construction
Ransomware hit an Australian construction consultancy in August 2026. Why construction companies…
Read article →RansomwareAustralia's 72-hour ransomware reporting rule
Ransomware payment reporting in Australia: pay a ransom and you have 72 hours to report it to the…
Read article →Managed ITMSP vs MSSP: which do you need?
MSP vs MSSP: an MSP keeps your IT running; an MSSP watches for attacks 24/7. See them side by side…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.