Ransomware Reporting Mandates: Understanding Australia’s Latest Cybersecurity Laws

Cyber ransom attacks and their impacts

The economic impact of a ransomware attack can be immense. It may include payments for fines, legal fees and complex remediation efforts. Some ransomware attacks also involve extorting money from companies to prevent their data from being released or sold online.

Operationally, this can lead to critical downtime, loss of customer trust and damage to the company's reputation. All these can have hard-hitting, long-term impacts on organisations.

In 2023, Australian businesses paid an estimated $9.27 million on average in response to ransomware attacks.²

About the new legislation

The latest legislative package aims to give the government better insight into ransomware attackers and trends to monitor, manage and stay ahead of ransomware hazards. With more accurate data, it can better allocate resources and timely support to affected businesses.

Mandatory reporting

Previously under Australian law, businesses were not legally mandated to disclose information regarding cyber ransom payments. The new legislation is intended to close this gap and give governmental authorities transparency over the extent of cyber ransoms paid by businesses operating in Australia.

To that end, it mandates a no-fault, no-liability ransomware reporting obligation for businesses without completely restricting individual businesses' ability to negotiate with ransomware attackers.

Tackling cybersecurity challenges amid new regulations

Today's business managers face complex cybersecurity challenges, intensified by limited budgets and human resources. Many lack dedicated IT staff to identify and address cyber threats effectively. They also often fall short of implementing appropriate controls and policies to prevent serious data breaches.

Lack of awareness about cybersecurity and relevant employee training compounds these challenges, leaving organisations susceptible to sophisticated ransomware attacks and advanced persistent threats (APTs).

The latest mandate adds another layer of complexity, as businesses must navigate stringent local and international data protection laws and mandatory reporting. While the new regulations require businesses to enhance their ransomware protection and overall cybersecurity, they also necessitate establishing internal processes to comply with new reporting requirements, as there are tiered penalties for non-compliance.

Larger organisations must be extra cautious, as their size attracts greater scrutiny from auditors and regulatory bodies. Government mandates impose stricter regulations on larger entities to ensure critical services remain risk-free.

Moreover, ransomware techniques are steadily evolving; with ransomware-as-a-service becoming more prolific, the nature of attacks will only become more sophisticated.

Businesses must up the ante by adopting strategic cybersecurity measures, investing in advanced cybersecurity tools and developing robust incident response plans to build resilience against cyber ransom threats. Exploring cyber insurance options can provide a crucial safety net, helping to detect, manage and mitigate a cyber incident efficiently.

How Gallagher can help

Gallagher's cyber practice team helps businesses adapt to evolving regulations and their implications for business management, including the liability of directors and officers. Our services include threat response and remediation, reputation management and regulatory action handling.

Our specialists continually manage evolving cyber risks, including strategic negotiating with threat actors making cyber ransom demands. Alongside our cyber risk management services, we offer robust and comprehensive cyber insurance policies that cover data breaches, business interruptions, legal expenses and more, all in one place.

connect with us