27 Obligation to report following a ransomware payment

• (1) The reporting business entity must give the designated Commonwealth body a report (a ransomware payment report) that complies with the requirements of this section within 72 hours of making the ransomware payment or becoming aware that the ransomware payment has been made (whichever is applicable).

Note: For the definition of designated Commonwealth body: see section 8.

• (2) The ransomware payment report must contain information relating to the following, in accordance with any requirements prescribed by the rules, that, at the time of making the report, the reporting business entity knows or is able, by reasonable search or enquiry, to find out:
• (a) if the reporting business entity made the payment—the reporting business entity’s contact and business details;
• (b) if another entity made the payment—that entity’s contact and business details;
• (c) the cyber security incident, including its impact on the reporting business entity;
• (d) the demand made by the extorting entity;
• (e) the ransomware payment;
• (f) communications with the extorting entity relating to the incident, the demand and the payment.
• (3) The reporting business entity may include other information relating to the cyber security incident in the ransomware payment report.
• (4) The ransomware payment report must be given:
• (a) in the form approved by the Secretary (if any); and
• (b) in the manner (if any) prescribed by the rules.
• (5) An entity is liable to a civil penalty if the entity contravenes subsection (1).

Civil penalty: 60 penalty units.

• (6) Subsection 93(2) of the Regulatory Powers Act does not apply in relation to a contravention of subsection (1) of this section.