Following legislation enacted last Friday, Australian victims of ransomware attacks are now legally required to declare any payments made to cyber criminals.
The new mandate is not universal but targets organizations with an annual turnover of over AUS $3 million and a select group of entities operating within vital critical infrastructure sectors. Notably, the threshold is expected to encompass approximately 6.5% of all registered businesses in Australia, collectively representing roughly half of the nation’s economic activity.
These designated entities are now obligated to report any ransomware payments to the Australian Signals Directorate (ASD) within a tight 72-hour window. Failure to comply could result in substantial penalties.
However, the government will focus on extreme cases for a start and engage with other victims until next year when a stricter regulatory stance will be adopted.
The primary driver behind the legislation is the need for enhanced visibility into the ransomware threat landscape. Until now, reporting such incidents and payments has largely been voluntary, leading to a significant underestimation of the true scale and financial impact of these cyberattacks. “Current voluntary reporting mechanisms are underutilised and consequently, ransomware and cyber extortion attacks remain significantly underreported,” the Australian government highlighted when the bill was first proposed last year.
Data from the Australian Institute of Criminology suggests that only one in five victims of a ransomware attack report the incident.
The rule follows a series of high-profile cyberattacks that have plagued Australian private businesses, including major breaches affecting Optus, Medibank, and MediSecure, pushing cybersecurity to the forefront of the national political agenda.
PIVX. Your Rights. Your Privacy. Your Choice.
To stay on top of PIVX news please visit PIVX.org and Discord.PIVX.org.