Australian Businesses Gear Up for Ransom Reporting Deadline

Australian organizations have about 40 days to prepare for a new law requiring mandatory reporting of ransomware payments to authorities.

See Also: Demostración Del Producto: Backup Y Recuperación De VM

The Cyber Security Act 2024, passed by both houses of the parliament in November, will make it obligatory for certain businesses to report cybersecurity incidents as well as payments made to ransomware operators, starting May 30. A failure to report incidents or payments may attract a maximum fine of 60 penalty units, presently AU$19,800. Australia assesses fines through units whose value increases over time, with one unit currently worth AU$330.

The reporting mandate applies to organizations that have an annual turnover of at least AU$3 million, or $1.91 million, and those designated as critical infrastructure operators. These organizations constitute about 6.5% of registered businesses and must report ransomware payments within 72 hours to the Australian Signals Directorate.

The government first introduced the ransomware reporting obligation in its draft cybersecurity bill, released early 2024, to ensure that agencies have “clear intelligence on the extent and impact of the ransomware threat on Australian businesses (see: Australia May Require Businesses to Report Ransom Payments).”

The Home Office’s Office of Impact Analysis stated that under-reporting of ransomware payments limited the government’s understanding of the cyberthreat landscape, and the reporting obligation will help it “break the ransomware business model.”

The reporting mandate requires organizations to report the ransom payment amount, how and when the payment was made, the impact of the attack on the business, the original extortion demand and any “communications with the extorting entity relating to the incident, the demand and the payment.”

According to ASD figures, the lead cybersecurity agency responded to 118 reported ransomware incidents in 2022-23, but the government believes the true number of ransomware payments was much higher with victim organizations failing to report them out of a fear of regulatory action, fines, lawsuits, or because of a lack of established mechanism to report ransomware incidents to authorities.

To allay industry concerns over the possibility of agencies using information related to ransomware incidents or payments to prosecute victim organizations, the government introduced a “limited use obligation” to ensure that victim organizations will not face legal action or regulatory penalties for the information they share with investigative agencies.