Australia has taken a decisive step by mandating that certain organisations disclose any ransomware payments made following a breach.

The policy aims to build a clearer picture of how often victims pay and how much criminals collect.

Officials argue that better data will sharpen national defences and guide policy responses.

Yet many experts warn the approach could be a double-edged sword with complex trade-offs.

The rule applies to companies running a business in Australia with annual turnover of A$3 million or more, as well as critical-infrastructure entities.

Under the law, affected organisations must report incidents to the Australian Signals Directorate and disclose any payments within 72 hours.

Failure to comply can trigger civil penalties under the country’s enforcement system.

Authorities plan a two-stage rollout, prioritising major breaches while maintaining “constructive” dialogue with victims.

The shift from voluntary to mandatory reflects concerns that previous disclosures were inadequate.

League reports estimate only one in five ransomware victims reported attacks in 2024, leaving shadow data that hampers government strategy.

The new requirement may encourage victims to come forward, but it also raises questions about stigma, victim-shaming and the risk of disclosing sensitive incident details.

While designed to enhance transparency, the policy also confronts the complex business of ransomware.

Threat actors often target smaller firms, demand payment in cryptocurrency or services, and leverage anonymity.

Some cybersecurity analysts argue that mandating disclosure will reveal attacker behaviour, tilt the economics of extortion and deter future payments.

Others suggest it may simply move activity underground or delay payment decisions.

The law brings immediate implications for boards and risk teams.

Companies in scope must prepare for rapid incident response, strengthen testing of backup systems and establish executive decision-making protocols.

Attention will also focus on how the regulator uses reported data, safeguards confidentiality and protects victims from reputational harm.

Australia’s move could reshape global norms around ransomware reporting.

Success hinges not just on data collection, but on the extent to which the disclosed information leads to actionable intelligence, faster disruption of attacker infrastructure and improved sector-specific guidance.

For now, the message is clear: when it comes to ransomware payments, transparency is becoming compulsory.