Скачать или смотреть Australia's Bold Move: Unveiling Ransomware Payments

Australia has made a bold move by implementing a new policy that requires certain organizations to disclose ransomware payments. This step aims to shed light on the frequency and scale of these payments. While officials believe better data will enhance national security, experts warn of potential drawbacks.
The rule applies to businesses with an annual turnover above $1.93 million, targeting the top 6.5% of registered companies. These organizations must report incidents to the Australian Signals Directorate (ASD) and disclose any payments made. Non-compliance can result in civil penalties.
The shift from voluntary to mandatory reporting is a significant change, as regulators found that voluntary disclosures were insufficient. Only about 20% of victims came forward in 2024, limiting the government's understanding of the threat. Starting next year, officials plan to take a stricter stance to strengthen accountability.
The key question remains: will this policy deter attacks or simply reveal more incidents? Some fear it may lead to public shaming of victims. Jeff Wichman, director of incident response at Semperis, highlights the potential ambivalence of the requirement.
A recent study by Semperis found that over 70% of companies affected by ransomware chose to pay the ransom. This highlights the pressure leaders face when operations, customers, and revenue are at stake. However, payment is not a guaranteed solution, as only 60% of paying victims received functional decryptors.
The new rule has immediate implications for organizations, requiring them to prepare for rapid reporting, documentation, and governance around ransom-related decisions. Companies must also focus on resilience to reduce the need for payment.
Key actions include building a clear ransomware playbook, establishing reporting workflows to the ASD, validating backups, strengthening identity controls, conducting tabletop exercises, and aligning with insurers and external counsel.
While mandated reporting promises transparency, it also carries the risk of reputational damage. Policymakers must ensure that shared intelligence leads to concrete improvements in security and that companies see the benefits of reporting.
Australia's move could set a global precedent for ransomware reporting, influencing other jurisdictions. The success of this policy will depend on consistent enforcement, robust data handling, and timely feedback to victims. If the data improves collective readiness, it could shift the dynamics of cyber extortion. However, if not, attackers may adapt, and victims will continue to face difficult choices, now under increased scrutiny.