The mandatory ransomware and cyber extortion reporting regime under the Cyber Security Act 2024 (the Act) officially commenced on 30 May 2025, requiring entities to report on ransomware and cyber extortion incidents in where a ransom has been demanded and paid. This regime marks a pivotal shift in Australia’s cyber security regulatory landscape.
Ransomware and cyber extortion attacks are increasing in frequency, yet many remain unreported. By mandating incident reporting, the Government aims to build a clearer picture of the threat landscape, deliver tailored support to affected entities, disrupt criminal operations, and strengthen Australia’s national cyber resilience.
To support a smooth transition to the new reporting requirements, implementation is split across two phases.
- Phase 1: From 30 May to December 2025, the Department is focusing on education and engagement. The Department is driving awareness through hosting Town Hall sessions, devolvement of fact sheets, FAQs, and user guidance materials. Enforcement is limited to serious non-compliance, providing businesses time to adapt before Phase 2.
- Phase 2: From January 2026, the Department will shift to a combined education, compliance and enforcement focus. By this stage, entities are expected to be familiar with the framework and reporting obligations.
Part 6 of the Act establishes the framework for regulatory oversight, outlining how the Government enforces compliance with cyber security obligations. This includes powers to conduct investigations, issue infringement notices, seek injunctions, and impose civil penalties.
How to submit your survey
To participate in the Ransomware Survey, please complete and submit the Survey Form by midnight 30 November 2025.
Please take the time to provide thoughtful and accurate responses. Your input will help:
- Improve the ransomware reporting form
- Inform future guidance and education materials
- Identify areas where businesses may need support
- Enhance user experience and streamline data collection
The survey will take approximately 4 – 7 minutes to complete, your time is greatly appreciated.
Important to note:
- Once the survey is submitted, your responses cannot be changed. Please read each question carefully before completing and submitting the form. The survey responses remain anonymous.
- If you would like the Department to follow up with you following the completion of the report, please include your contact details and a brief note on the final question of the survey.
- If you have any questions regards the process, require assistance or adjustments to complete the application process, please contact
Reporting@HomeAffairs.gov.au.
