72 Hours: Australia's Ransom Payment Reporting Rule

Key takeaways

Mandatory ransomware and cyber extortion payment reporting under the Cyber Security Act 2024 has been active since 30 May 2025
The obligation applies to a “reporting business entity”: one with annual turnover exceeding AUD $3 million in the previous financial year, or a responsible entity for a critical infrastructure asset under Part 2B of the Security of Critical Infrastructure Act 2018
The 72-hour reporting clock starts at the moment a payment is made, or the moment you become aware a payment was made on your behalf, not at the moment the incident was discovered
A ransom demand you receive but never pay triggers no mandatory report
Reports go to the Australian Signals Directorate through the reporting form at cyber.gov.au
Failing to report can attract a civil penalty of 60 penalty units under section 27 of the Act
The regime moved from an education-first Phase 1 (30 May 2025 to 31 December 2025) into an active compliance-and-education Phase 2 from 1 January 2026
Report information is protected: under section 32 of the Act it generally cannot be used as evidence against the reporting entity in civil or criminal proceedings

As at 15 August 2026, any Australian business with annual turnover over AUD $3 million that pays a ransomware or cyber extortion demand, or learns a third party paid one on its behalf, must report that payment to the Australian Signals Directorate within 72 hours, under Part 3 of the Cyber Security Act 2024. The clock starts at the payment, not the attack. A demand you never pay does not need to be reported. Missing the deadline can attract a civil penalty of 60 penalty units.

Picture a Saturday night at a busy cosmetic clinic. The practice manager gets a call from an after-hours receptionist: the booking system will not load, and a text file on the desktop is demanding payment in bitcoin to unlock it. By Monday morning, the owner has decided to pay rather than lose a week of appointment history. Nobody in that decision chain is thinking about a 72-hour government reporting clock, because nobody told them one exists.

This post covers what the reporting rule actually says, who it catches, what it means for the incident response workflow behind your practice management system, and where the honest limits of that advice sit.

What the Rule Says

The Department of Home Affairs administers the mandatory ransomware and cyber extortion payment reporting obligation under Part 3 of the Cyber Security Act 2024, active since 30 May 2025. Reported plainly: if you are a reporting business entity and you make a ransomware or cyber extortion payment, or become aware a payment has been made on your behalf, you have 72 hours from that payment to submit a report using the form on the Australian Signals Directorate’s website at cyber.gov.au.

Three things the Department’s own factsheet is explicit about. First, the trigger is the payment, not the incident and not the demand. An entity that receives a ransom demand and never pays it has no mandatory reporting obligation at all. Second, “payment” is defined broadly. Under Part 3, both monetary and non-monetary benefits given or exchanged with an extorting entity count, including gifts or services provided in response to the demand, not just a bitcoin transfer. Third, physical extortion threats and scam-related attacks sit outside this scheme entirely; those go to Scamwatch instead, not the ASD ransomware reporting form.

The obligation is being phased in. Phase 1, an education-first approach, ran from 30 May 2025 to 31 December 2025, during which Home Affairs aimed to pursue regulatory action only for egregious non-compliance. Phase 2, described as a compliance-and-education approach, started 1 January 2026 and carries a more active regulatory focus. As at the date of this post, the regime has been in Phase 2 for over seven months.

Takeaway: the obligation is not new, but the regulator’s tolerance for a missed report has already changed once, and it changed toward stricter, not softer.

Who Counts as a Reporting Business Entity

Section 26(2) of the Act defines a reporting business entity by three tests, and a business only needs to meet one of the turnover or infrastructure tests, not both.

Scenario	Reporting business entity?	Why
Annual turnover over $3 million last financial year, ransom paid	Yes	Exceeds the section 6 turnover threshold in the Rules
Annual turnover under $3 million, ransom paid	No, unless critical infrastructure	Below the turnover threshold and not a Part 2B responsible entity
Annual turnover over $3 million, demand received, nothing paid	No report required	Mandatory reporting is triggered by payment, not by a demand
Responsible entity for a critical infrastructure asset, any turnover, ransom paid	Yes	Captured through Part 2B of the Security of Critical Infrastructure Act 2018 regardless of turnover
Commonwealth or State government body	No	Explicitly excluded from the definition of a reporting business entity

Trading for only part of the financial year does not exempt a business, it just changes the number. Section 6 of the Cyber Security (Ransomware Payment Reporting) Rules 2025 sets the threshold as $3 million multiplied by the number of days the business traded in the previous financial year, divided by 365. A clinic that opened 91 days before the end of its financial year is captured once its turnover for that period exceeds a proportionally smaller figure, not the full $3 million.

Pro-Rata Turnover Threshold by Trading Days

Those figures are not a published statistic. They are the section 6 formula applied to four illustrative trading periods, so a newly opened practice can see roughly where its own threshold sits before reaching for a calculator.

Takeaway: a clinic that opened partway through the financial year is not automatically exempt from reporting, it just has a lower turnover bar to clear.

What That Means for the Build

Most practice management systems have nowhere to record any of this, because until an incident happens, nobody thought to add it. Three structural gaps show up consistently once a clinic actually needs to file a report.

Separate the incident-detected timestamp from the payment-made timestamp. The 72-hour clock in section 27 of the Act runs from the moment a payment is made, or the moment you become aware a payment was made on your behalf, not from when you first noticed the attack. A single incident_reported_at field in your internal incident log is not enough. You need two fields: incident_detected_at and payment_made_at (or payment_awareness_at if a third party paid on your behalf), because the deadline is calculated from the second one, and conflating them is the single easiest way to miss the window without realising it.

Build a cyber_incident record, not a support ticket. Whatever system your practice already uses for IT issues, a ransomware event needs its own structured record with fields for: ABN, incident type, ransomware variant (if known), vulnerability exploited (if known), demand amount and method, payment amount and method, and a timestamped log of communications with the extorting entity. Section 7 of the Rules asks for all of this on the report form, and reconstructing it from memory three days after a stressful weekend is worse than pulling it from a record kept as the event unfolded.

Name one accountable role for filing, with an after-hours path. The report goes through a form at cyber.gov.au, not an API your booking software can call automatically. Somebody has to log in and submit it. Put a name (or a rotating on-call role) against that responsibility in your incident response document, with a deadline calculated from the payment timestamp, not a vague “as soon as possible.”

72-Hour Ransomware Reporting Clock

The green zone is the window the Act gives a reporting business entity. Once the clock passes 72 hours from the payment, the entity has moved into the pink zone regardless of how quickly the attack itself was contained.

Takeaway: the build fix is two extra timestamp fields and one named accountable role, not a new piece of software.

Worked Example: One Clinic Caught, One Clinic Not

Cosmetic clinic. A Perth cosmetic injectables clinic had turnover of $4.2 million in the last financial year, well over the $3 million threshold. Ransomware locks its booking system on a Saturday night; the practice manager isolates the affected server Sunday morning (incident_detected_at). The owner decides to pay $18,000 through the clinic’s IT vendor on Monday at 9am (payment_made_at). The 72-hour deadline runs from Monday 9am, not from Sunday morning, so the report is due by Thursday 9am. If the clinic’s team mistakenly calculated the deadline from the Sunday detection time, it would believe it had until Wednesday morning, a full day earlier than the real deadline, and would have no reason to think it had made an error.

Cosmetic dentistry practice. A dental practice with turnover of $2.1 million in the last financial year faces an identical attack and pays a $6,000 ransom to restore its patient records system. Because its turnover sits under the $3 million threshold, and it is not the responsible entity for a critical infrastructure asset, it is not a reporting business entity under section 26(2). No mandatory report to the Australian Signals Directorate is required for this payment, though voluntary reporting of the incident is still encouraged.

The gap between those two outcomes is the turnover threshold alone. Same attack, same decision to pay, different legal obligation.

Takeaway: turnover, not the severity of the attack or the size of the ransom, decides whether the 72-hour clock applies to your practice.

What to Check on Your Own Site

Do you know your practice’s actual turnover for the last financial year, not a rough guess, against the $3 million threshold?
Does your incident response document record incident_detected_at and payment_made_at as two separate fields, not one?
Is there a named role, with an after-hours contact method, responsible for filing the report at cyber.gov.au within 72 hours of a payment?
Do you have your practice’s ABN, and any paying third party’s ABN, ready to enter on the report form without having to chase it down mid-incident?
Are communications with an attacker (ransom notes, negotiation chats, payment confirmations) retained and timestamped rather than deleted once the immediate crisis is over?
Does your team understand that receiving a demand and never paying it does not require a report, so a scare alone should not trigger a panicked filing?
If patient records were exposed, has someone separately assessed whether the incident also triggers the Notifiable Data Breaches scheme under the Privacy Act, which applies to health service providers regardless of turnover and is assessed independently of this reporting obligation?

Enforcement Anchor

No public infringement notice, court proceeding, or named enforcement action against a business for failing to report a ransomware payment under the Cyber Security Act 2024 turned up in this research pass, and none should be invented to fill that gap. That is broadly consistent with what the Department of Home Affairs has published about its own posture: Phase 1 (30 May 2025 to 31 December 2025) was explicitly education-first, with regulatory action reserved for egregious non-compliance, and Phase 2 (from 1 January 2026) is described as compliance-and-education, not enforcement-first. What does exist, and has teeth on paper, is the stated civil penalty: 60 penalty units under section 27 of the Act for a reporting business entity that fails to make a required report. Treat the absence of a public case as a young regime without a published test case yet, not as evidence the obligation goes unenforced.

Where This Gets Hard

The factsheet is clear on the mechanics: who is caught, what triggers the clock, and what the report needs. It is far less clear on judgment calls a practice manager will actually face at 11pm on a Sunday. Whether a service credit demanded by an attacker counts as a “non-monetary benefit” payment, exactly when a business “becomes aware” a third-party IT vendor paid on its behalf if the vendor is slow to disclose that, and how a multi-site clinic group with a shared IT vendor determines which entity is the reporting business entity, are all scenarios the published guidance gestures at without resolving down to the level of a specific booking system or vendor contract.

There is a second honest limit worth naming directly. This post reports what the Department of Home Affairs factsheet states about the Act and the Rules; it is not a substitute for reading section 26, section 27, and sections 29 to 32 of the Cyber Security Act 2024 itself, or the Cyber Security (Ransomware Payment Reporting) Rules 2025, on the Federal Register of Legislation. The regulator says a reporting business entity that pays a ransom has 72 hours to report it; the build consequence is two accurate timestamp fields and one named accountable person; whether your specific incident and payment structure triggers the obligation is a question for your lawyer or your cyber incident response provider, not a website audit.

Status

As at 15 August 2026, the mandatory ransomware and cyber extortion payment reporting obligation under Part 3 of the Cyber Security Act 2024 is in force and has been since 30 May 2025. It is not a proposal and not a passed-but-uncommenced provision. The regime is currently in its second implementation phase, described by the Department of Home Affairs as a compliance-and-education approach, which began 1 January 2026.

Frequently Asked Questions

Does my clinic have to report a ransomware payment to the government?

Only if your practice had an annual turnover over AUD $3 million in the previous financial year (or the pro-rata equivalent for a partial year), or you are the responsible entity for a critical infrastructure asset, and you made, or became aware someone made on your behalf, a ransomware or cyber extortion payment. If those conditions are met, section 27 of the Cyber Security Act 2024 gives you 72 hours from the payment to report it to the Australian Signals Directorate.

What happens if we miss the 72-hour deadline?

A civil penalty of 60 penalty units can apply under the Act. Home Affairs ran an education-first Phase 1 from 30 May 2025 to 31 December 2025 and moved into an active compliance-and-education Phase 2 from 1 January 2026, so the regulator’s posture is now less forgiving than it was in year one.

Do we have to report a ransom demand we received but did not pay?

No. Mandatory reporting under Part 3 of the Cyber Security Act 2024 is triggered by a payment, not a demand. If you never pay and no payment is made on your behalf, no report is required, though voluntary reporting of the incident to the Australian Signals Directorate is encouraged.

Get Your Incident Response Workflow Checked

RockingWeb reviews the fields, timestamps, and escalation paths behind a clinic’s incident response process and flags exactly where a ransomware payment could slip past the 72-hour reporting window unnoticed.

Talk to RockingWeb

Sources and References

Department of Home Affairs - Factsheet: Mandatory ransomware and cyber extortion payment reporting is active from 30 May 2025. Date checked: 15 August 2026.
Cyber Security Act 2024 (Cth), Part 3, sections 26, 27 and 29 to 32, as described in the Department of Home Affairs factsheet above. Federal Register of Legislation, legislation.gov.au. Date checked: 15 August 2026 (the specific instrument page was not independently verified in this research pass; provisions named per the Department’s factsheet).
Cyber Security (Ransomware Payment Reporting) Rules 2025, section 6 (turnover threshold formula) and section 7 (report content requirements), as described in the Department of Home Affairs factsheet above. Date checked: 15 August 2026 (specific instrument page not independently verified; provisions named per the Department’s factsheet).
Australian Signals Directorate - Report a cyber security incident, the reporting channel named in the Department’s factsheet. Date checked: 15 August 2026.
Security of Critical Infrastructure Act 2018 (Cth), Part 2B, referenced in the reporting business entity definition, as described in the Department of Home Affairs factsheet above. Federal Register of Legislation, legislation.gov.au. Date checked: 15 August 2026 (specific instrument page not independently verified; provision named per the Department’s factsheet).

Last reviewed: 15 August 2026.