Ransomware in Australia: what to do and the 72-hour payment reporting rule
By the ITLAW Team · Updated November 2026 · General information, not legal advice
In short
- Ransomware encrypts or steals your data and demands payment for its return or non-publication.
- Businesses with turnover above $3 million must report any ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours.
- If personal information is involved, the Notifiable Data Breaches scheme may also require notification.
Ransomware is malicious software that locks users out of their systems, usually by encrypting files, and demands payment, often in cryptocurrency, for a decryption key. Modern attacks increasingly use “double extortion”: criminals copy data before encrypting it and threaten to publish it unless paid. Professional services firms, including law and accounting firms, are attractive targets because they hold confidential client information and cannot afford downtime.
How ransomware gets in
- phishing emails with malicious links or attachments
- stolen or reused passwords, especially without multi-factor authentication
- unpatched remote access systems and VPNs
- compromised IT service providers with access to many clients
Your legal obligations after an attack
Ransomware is a crime, but victims also have obligations:
- Ransomware payment reporting: under the Cyber Security Act 2024 (Cth), businesses with annual turnover above $3 million, and critical infrastructure entities, must report a ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours of making it or becoming aware of it.
- Data breach notification: if personal information has been accessed or is likely to be published, the Notifiable Data Breaches scheme may require notification to the OAIC and affected individuals.
- Critical infrastructure: responsible entities must report significant cyber incidents within 12 hours.
- Contracts and insurance: client contracts and cyber insurance policies often require prompt notice.
Should you pay?
The Australian Government advises against paying ransoms. Payment does not guarantee recovery or deletion of stolen data, may fund further crime and, if the recipient is a sanctioned person or entity, can itself be an offence. Paying is not generally illegal, but it must be reported if you are covered. Get legal and expert advice before any payment decision.
Prevention basics
- multi-factor authentication on email and remote access
- prompt patching of systems and applications
- offline, tested backups
- staff training on phishing
- an incident response plan with contacts for your insurer, IT responder and lawyer
For a step-by-step incident checklist, see our data breach and cyber security guide. You can report attacks and get help at cyber.gov.au.
Need advice?
Our guides are general information. For advice on your circumstances, send us an enquiry and an ITLAW lawyer will get back to you, usually within one business day.
Frequently asked questions
Do I have to report a ransomware attack in Australia?
You must report a ransomware payment within 72 hours if your turnover exceeds $3 million or you are a critical infrastructure entity. Separate notification duties may apply if personal information is involved.
Is it illegal to pay ransomware in Australia?
Not generally, but payments to sanctioned persons or entities can be an offence, and covered businesses must report payments. The Government advises against paying.
