InfoSecBulletin Cybersecurity for mankind
New ransomware payment reporting rules take effect in Australia yesterday (May 30) for all organisations with an annual turnover of AUS $3 million ($1.93 million).
Australia’s Cyber Security Act 2024 applies to private companies managing critical infrastructure assets.
Organizations must report any ransomware payments to the Australian Signals Directorate (ASD) within 72 hours of making the payment or being informed of it.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
The report must include the following information:
The ransomware payment amount demanded and paid
The method of provision that was demanded and used
Details on the nature and timing communication with the attackers
The requirements do not apply to public sector bodies.
Failure to comply can result in civil penalties.
Australia is the first country to require mandatory reporting of ransomware payments.
Australia’s Cyber Security Act 2024 requires smart device manufacturers to meet new security standards starting in 2026.
The law will establish a new Cyber Incident Review Board to evaluate major cybersecurity incidents after they occur. This could see senior executives face scrutiny over the cyber strategy decisions.
Reporting Rules Aim to Boost Ransomware Visibility:
The new rules aim to make it easier to see ransomware attacks, assisting government and law enforcement in their efforts to fight against threat actors.
Ransomware incidents are likely underreported. The Australian Institute of Criminology found that only one in five victims report cyber-attacks to authorities.
The requirement to make payments public could also serve as a deterrent to ransomware victims to pay their extorters.
Commenting on the reporting rules, Tim Dillon, Director of Professional Services, APAC, NCC Group, said: “The introduction of Australia’s latest cybersecurity laws is a significant step in bolstering national digital resilience against an ever-evolving threat landscape. Governments and regulators globally are grappling with limited visibility into cyber risks – particularly ransomware – which hinders their ability to effectively detect, disrupt, and deter cyber-attacks.”
The UK government is currently seeking input on plans to make reporting ransomware incidents mandatory and to prohibit payments by public sector and critical infrastructure organizations.
Recent research has shown that more victims of ransomware are refusing to pay attackers, with Chainalysis finding that payments fell 35% in 2024 compared to 2023.
