InfoSecBulletin Cybersecurity for mankind
New ransomware payment reporting rules take effect in Australia yesterday (May 30) for all organisations with an annual turnover of AUS $3 million ($1.93 million).
Australia’s Cyber Security Act 2024 applies to private companies managing critical infrastructure assets.
Organizations must report any ransomware payments to the Australian Signals Directorate (ASD) within 72 hours of making the payment or being informed of it.
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
The report must include the following information:
The ransomware payment amount demanded and paid
The method of provision that was demanded and used
Details on the nature and timing communication with the attackers
The requirements do not apply to public sector bodies.
Failure to comply can result in civil penalties.
Australia is the first country to require mandatory reporting of ransomware payments.
Australia’s Cyber Security Act 2024 requires smart device manufacturers to meet new security standards starting in 2026.
The law will establish a new Cyber Incident Review Board to evaluate major cybersecurity incidents after they occur. This could see senior executives face scrutiny over the cyber strategy decisions.
Reporting Rules Aim to Boost Ransomware Visibility:
The new rules aim to make it easier to see ransomware attacks, assisting government and law enforcement in their efforts to fight against threat actors.
Ransomware incidents are likely underreported. The Australian Institute of Criminology found that only one in five victims report cyber-attacks to authorities.
The requirement to make payments public could also serve as a deterrent to ransomware victims to pay their extorters.
Commenting on the reporting rules, Tim Dillon, Director of Professional Services, APAC, NCC Group, said: “The introduction of Australia’s latest cybersecurity laws is a significant step in bolstering national digital resilience against an ever-evolving threat landscape. Governments and regulators globally are grappling with limited visibility into cyber risks – particularly ransomware – which hinders their ability to effectively detect, disrupt, and deter cyber-attacks.”
The UK government is currently seeking input on plans to make reporting ransomware incidents mandatory and to prohibit payments by public sector and critical infrastructure organizations.
Recent research has shown that more victims of ransomware are refusing to pay attackers, with Chainalysis finding that payments fell 35% in 2024 compared to 2023.
