Aussie Law Makes Big Firms Report Ransom Payments

Aussie law makes big firms report ransom payments

: Move should help government track infections and plan new legislation

Ransomware attack, promotion rounds, and solicitor shot: What’s hot in law this week (26–30 May)

While a law firm grappled with a former client over an unpaid $450,000 bill, a major legal body was hit with a ransomware attack, and a BigLaw practice announced its latest promotion round. Here is your weekly round-up of the biggest stories for Australia’s legal profession.

Australian ransomware victims now must tell the government if they pay up

Australia is now the first country to require ransomware victims to report if they make any extortion payments to their attackers.

New ransomware rules for businesses: Are you prepared for an attack?

What is ransomware? Ransomware is a type of malware used to extort businesses and individuals. It locks you out of your own files and demands a ransom, usually in cryptocurrency, to get them back. From today, businesses are legally required to report ransomware payments. If someone extorts payment from you by locking up your data, you now have 72 hours to tell the Government – or potentially face disciplinary action. The rule change will apply …

Ransomware reporting rules require all businesses to do a risk assessment

Australian businesses with an annual turnover of more than $3 million and entities responsible for critical infrastructure must report to the government within 72 hours of making a ransomware payment, or becoming aware that one has been made on their behalf, under the Ransomware Reporting Rule of the Cyber Security Act 2024. Effective 30 May 2025, payment reports will not be limited to direct payments but will also include those made by third pa…

Ransomware reporting rules begin in June: 5 CEO questions answered

From May 30, 2025, Australia’s new Ransomware Payment Reporting Rules come into play. This means businesses will be legally required to report ransomware payments within strict timeframes. This is part of a broader effort to enhance transparency and strengthen national cybersecurity, alongside the establishment of a Cyber Incident Review Board. This mandatory reporting will help the government better understand the scale and nature of ransomware…