June 5, 2025 - Blog Digital New

Canberra authorities are embracing a tough approach to ransomware threats. A new law will require certain organizations to disclose when and how much they have paid to cybercriminals following a data breach. However, experts remain unconvinced that this is the most effective way to tackle the problem.

Australia has taken a bold step forward in the fight against cybercrime by becoming the first country to mandate the disclosure of ransomware payments. Under this groundbreaking law, companies operating in Australia are now required to report any payments made to cybercriminals following a ransomware incident. With many enterprises still succumbing to ransom demands imposed by file-encrypting malware, this regulation aims not only to curtail such practices but also to provide government officials with valuable insights into the scale and frequency of these attacks.

Originally proposed last year, this legislation targets companies with an annual turnover exceeding $1.93 million, effectively focusing on the top 6.5 percent of registered businesses—those that account for approximately half of Australia’s economic output. By imposing stricter reporting requirements under the #Australian Signals Directorate (ASD), the government hopes to create a more transparent landscape around cybersecurity incidents.

The implications of non-compliance are significant; firms that fail to disclose ransomware incidents may face hefty fines under Australia’s civil penalty system. This new law represents a necessary shift towards accountability and awareness in an era where cyber threats are ever-evolving and increasingly sophisticated. As companies adapt to these requirements, they will not only enhance their own security posture but also contribute to a collective defense against cybercriminals threatening our digital infrastructure.
Authorities are allegedly planning to follow a two-stage approach, initially prioritizing major violations while fostering a “constructive” dialogue with victims.

Starting next year, regulators will adopt a much stricter stance toward noncompliant organizations. The Australian government has implemented this mandatory reporting requirement after concluding that voluntary disclosures were insufficient. In 2024, officials noted that ransomware and cyber extortion incidents were vastly underreported, with only one in five victims coming forward.

Ransomware remains a highly complex and growing phenomenon, with attacks reaching record levels despite increased law enforcement actions against notorious cyber gangs. Although several governments have proposed similar regulations, Australia is the first country to formally enact such a law.