Does Your Practice Have to Report Ransomware Payments Now? The 72-Hour Rule Explained
If you run a medical practice, not-for-profit or small business in Mandurah, the Peel region or Perth, ransomware reporting probably isn’t something you spend much time thinking about.
But since May 2025, certain Australian businesses have been required to report ransomware and cyber extortion payments to the Australian Government. And from 1 January 2026, the government moved from its initial education-first approach to a more active compliance phase.
Hopefully, it’s a rule your business never needs to use. But if you ever find yourself dealing with a ransomware attack, knowing what you’re required to do beforehand can make an already stressful situation a little easier to manage.
What is the 72-hour ransomware reporting rule?
Under the Cyber Security Act 2024, certain Australian organisations must report ransomware or cyber extortion payments within 72 hours.
In simple terms, if your organisation pays a ransom following a cyber attack, you may need to report that payment to the Australian Government.
The important distinction is that the requirement is triggered by the payment, not simply by experiencing a ransomware attack.
So if a ransom demand is made but nothing is paid, this particular reporting obligation doesn’t apply.
Which businesses does it apply to?
The reporting obligation generally applies to:
- Businesses operating in Australia with annual turnover of $3 million or more in the previous financial year
- Responsible entities for certain critical infrastructure assets, regardless of turnover
For a smaller medical practice, NFP or local business, $3 million might sound well above your organisation’s size.
But it’s still worth checking rather than assuming you’re outside the rules. Multi-site practices, larger allied health providers and some not-for-profits can reach the threshold more quickly than you might think. If you’re unsure where your organisation sits, get advice before you ever need to rely on that answer during an incident.
What if your insurer makes the payment?
The reporting requirement can still apply if someone makes the ransomware payment on your behalf.
For example, your cyber insurer, incident response provider or another third party may handle negotiations and payment during an attack.
That doesn’t necessarily mean they’ve also taken care of the reporting.
If you already have cyber insurance or an incident response provider, it’s worth checking a few things now:
- Who is responsible for reporting if a ransomware payment is made?
- Will they submit the report on your behalf?
- Who within your organisation needs to be notified?
- What information will you need to provide?
These are much easier questions to answer now than in the middle of a ransomware incident.
Does your incident response plan cover it?
When most people think about a cyber incident response plan, they think about the technical response: disconnecting affected systems, protecting data, restoring backups and getting everyone working again.
Those things are important, but they’re only part of the response.
Depending on your organisation and what has happened, you may also need to manage reporting, insurance, privacy, and communication requirements.
Your incident response plan should make it clear:
- Who takes the lead when an incident happens
- Who contacts your IT and cyber security providers
- Who contacts your cyber insurer
- Who determines what needs to be reported
- Who is responsible for gathering the information needed for a ransomware payment report
- How this works alongside other requirements, such as notifying affected patients, clients or regulators
Most importantly, the people involved should know the plan exists and what their role is.
A document sitting untouched in a folder isn’t particularly useful when something actually goes wrong.
How Impact ICT can help
You don’t need to become a cyber security expert yourself. You do need to know that the right protections, plans and people are in place before there’s an incident.
Impact ICT works with healthcare providers, not-for-profits and businesses across Mandurah, the Peel region and Perth to improve their cyber security and prepare for the things that can disrupt day-to-day operations.
That can include reviewing your current cyber security environment, strengthening your approach against the Essential Eight, improving backup and business continuity, and making sure your incident response plan reflects how your organisation actually operates.
We’re also SMB1001 Platinum certified, giving our team a practical framework for helping Australian businesses improve their cyber security maturity without turning it into a box-ticking exercise.
If your incident response plan hasn’t been looked at for a while, or you’re not sure what would actually happen if your business was hit by ransomware, we can help you work through it.
Talk to Impact ICT about your cyber security and incident response planning →
This article provides general information only and isn’t legal advice. If you’re unsure how the ransomware payment reporting requirements apply to your organisation, speak with your legal adviser.
Frequently Asked Questions
Do small businesses have to report ransomware payments in Australia?
It depends on the business. The mandatory reporting requirement generally applies to businesses operating in Australia with annual turnover of $3 million or more in the previous financial year, as well as responsible entities for certain critical infrastructure assets. Smaller businesses below the threshold generally aren’t captured by this particular requirement.
What is the 72-hour ransomware reporting rule?
It’s a requirement under the Cyber Security Act 2024 for eligible organisations to report a ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours of the payment being made.
Who has to comply with Australia’s ransomware payment reporting regime?
Reporting business entities with turnover of $3 million or more in the previous financial year, and entities responsible for critical infrastructure assets. Enforcement moved from an education-first approach to active compliance from 1 January 2026.
If my insurer pays a ransom, do I still have to report it?
Potentially, yes. If a payment is made on your behalf, by an insurer, negotiator, or incident response firm, the reporting obligation can still sit with your organisation. This is worth confirming with your provider before an incident occurs.
What happens if a business doesn’t report a ransomware payment?
Non-compliance can result in civil penalties. Beyond the legal risk, failing to report can also complicate your organisation’s broader incident response and insurance position. Confirm current penalty details with your legal adviser, as guidance in this area continues to evolve.
