Is it illegal to pay a demand in Australia? In most cases, no. There is no general law that makes paying a ransom an offence in itself. It becomes one when the payment reaches a sanctioned person or group, or funds terrorism. In January 2024 Australia used its cyber sanctions powers for the first time, against the Russian national linked to the Medibank breach, and a payment to him would now be a criminal offence. Separately, a business with annual turnover above $3 million must report any ransomware payment to the Department of Home Affairs within 72 hours under the Cyber Security Act 2024. The Australian Government's advice is not to pay.
So the legal question is rarely the one that decides it. What decides it is whether paying would actually get your business back, and how much you can recover without the attacker's key. The reporting duty applies either way.
When ransomware locks up your business and a payment demand appears on the screen, one question tends to crowd out every other: do we just pay and make this go away? It is an understandable reaction. Operations have stopped, staff are standing around, and the attacker is offering what looks like the fastest way out.
The honest answer is that paying is usually a last resort, not a first move, and in many cases it is not even necessary. This guide walks through why, what Australian law now requires of you, and what to check before you consider paying. It is general guidance, not legal advice, and you should get your own advice on the specifics of your situation.
Paying does not guarantee you get your data back
A ransom demand is a promise from a criminal. When you pay, you are trusting that promise. Sometimes the attacker provides a working key. Often the result is worse than expected. The key may never arrive, it may decrypt slowly or incompletely, or the data may already be corrupted from the itself. A meaningful proportion of organisations that pay do not recover everything, and some recover nothing. You are buying a chance, not a certainty, and you are buying it from the party that attacked you.
You may not have to pay at all
Before payment even enters the conversation, it is worth knowing that a great deal of ransomware-encrypted data is recoverable without the attacker's key. There is a clear order to work through, from the cleanest option to the last resort.
- Clean, verified backups. If you have offline or immutable backups that were not reached by the attack, restoring from them is the simplest path. Check they are genuinely intact before trusting them.
- Volume shadow copies or snapshots, if the attacker did not delete them.
- Partial-encryption recovery. Many modern ransomware families encrypt large files only partially, for speed, which leaves most of the underlying data intact. Where that is the case, the surviving data can often be located and rebuilt without the key. This is exactly the path that has recovered business databases for Australian organisations after every backup had failed.
- A public decryptor, if one exists for the strain. These are rare, but worth checking through resources such as the No More Ransom project.
- Rebuilding from source systems, where the data can be regenerated from elsewhere.
The point is simple. Recovery is frequently a technical problem to be worked, not a payment to be made. The right question in the first hours is not "how much do we pay" but "what can we recover, and in what order."
Paying carries costs well beyond the ransom
Even set aside the money, payment has consequences that are easy to overlook under pressure.
- It funds and encourages the offender, and the wider criminal market that targets Australian businesses.
- It marks you as an organisation that pays. Victims who pay are more likely to be targeted again, sometimes by the same group.
- It may carry legal exposure. Depending on who is behind the attack, a payment can raise sanctions and other legal considerations, which is another reason to involve legal counsel early.
Do not assume the data-theft threat is real
Many attackers now claim to have stolen your data as well as encrypted it, and threaten to leak it unless you pay. Treat that claim as something to be assessed, not accepted. Data-theft claims in ransom notes are frequently a bluff, and even where data was taken, paying does not guarantee it is deleted. You would again be trusting a criminal to keep their word. What was actually accessed should be established through proper technical examination, not taken from the attacker's note.
What Australian law now requires
Two obligations are worth understanding, and both are reasons to bring in legal advice rather than act alone.
- Ransomware payment reporting. The Cyber Security Act 2024 requires a business with annual turnover above $3 million to report a ransomware or cyber extortion payment to the Department of Home Affairs within 72 hours of making it. The obligation has applied since 30 May 2025, and Home Affairs moved to an active enforcement posture from 1 January 2026. It is a separate duty, triggered by the act of paying, and it covers a payment made on your behalf by an insurer or negotiator.
- Notifiable data breaches. Under the Privacy Act, if was accessed, you may need to assess the breach and potentially notify the and the affected individuals. Unauthorised access can be enough to trigger this, and it applies regardless of whether you pay.
Neither obligation depends on the recovery outcome, and both can apply at the same time. Reporting the incident to the 's through ReportCyber, and to police, is also part of a proper response.
What to do in the first hours instead
The decisions you make early determine what is recoverable later, so the priority is preservation and containment, not payment.
- Isolate, do not power off. Disconnect affected machines from the network, but avoid wiping, re-imaging, or shutting them down, which can destroy recoverable data and evidence.
- Preserve everything. Keep the encrypted files, the ransom note, and the logs. Partially encrypted files are often recoverable, and deleting them forecloses that option.
- Protect and check your backups. Take them offline and verify whether they are intact before you rely on them.
- Engage incident response early. The right first moves, preservation, scoping, and containment, are what make recovery possible, and they are hard to get right under pressure.
How IronSights responds to a ransomware incident
Most of the calls we take start with the payment question. Our response starts somewhere else: with establishing what actually happened, because that answer decides whether you need to pay at all and what you must report. Every engagement we run follows the same six steps, and they are written into the proposal you sign so there is no ambiguity about what you are getting.
1. Mobilise and triage. We mobilise the same day and assign a senior incident lead as your single point of contact. We set up a secure channel outside your email and chat, which may be compromised, and scope what is affected.
2. Isolate and contain. Affected hosts come off the network with their state preserved as evidence rather than wiped. Compromised accounts are disabled and the attacker's remote access and command-and-control are blocked.
3. Investigate and reconstruct the . We confirm the strain and the entry point, then trace which accounts were used and how far the attacker moved. Firewall and egress logs tell us whether data left the network before encryption. That is the evidence that decides your notification obligations and whether a data-theft threat is real.
4. Eradicate and remediate. We remove the attacker's footholds and close the way they got in, which is most often an exposed remote access service. Credentials are reset and the exposed systems hardened before anything reconnects.
5. Recover and restore. Clean backups where they exist. Where they do not, we work the encrypted data itself: snapshots, then partial-encryption recovery, then a public decryptor if one exists for the strain. We also liaise with the ACSC and law enforcement on your behalf. No responder can guarantee decryption and we will not tell you otherwise, but a large share of what looks lost is recoverable.
6. Report and prevent recurrence. You receive a written report covering what happened, the root cause, our assessment of whether data was exfiltrated and a prioritised plan to stop it happening again, in a form you can hand to your insurer, board and lawyers, with guidance on your and Cyber Security Act obligations.
The recovery step is where we differ from most responders. Many ransomware families encrypt large files only partially, for speed, and the surviving data can often be rebuilt without the key. We built ScanCrypt, a free tool that shows how much of a file was actually encrypted, and we have used the approach to recover business databases after every backup had failed.
If you are dealing with an incident now, 1300 004 766 is answered 24 hours a day, and our incident response page sets out how an engagement works.
Frequently asked questions
Is paying a ransom illegal in Australia?
No, not in general. There is no law that makes paying a ransomware demand an offence in itself. It becomes an offence when the money reaches a sanctioned individual or group, or funds a terrorist organisation. Businesses with turnover above $3 million must also report any payment within 72 hours. Government advice is not to pay, and paying does not remove any of your other obligations.
Do I have to report a ransomware payment?
If your annual turnover is above $3 million, yes: to the Department of Home Affairs within 72 hours of the payment, under the Cyber Security Act 2024. Smaller businesses are encouraged to report but are not required to. This is separate from any notifiable data breach obligation under the Privacy Act. We cover the mechanics in our guide to the 72-hour ransomware payment report.
Can ransomware-encrypted data be recovered without paying?
Often, yes. Backups and snapshots first, then partial-encryption recovery, then a public decryptor if one exists for the strain. Whether it works depends on the strain and on nothing being wiped or re-imaged before an examination, so preserve everything. Our ransomware data recovery page explains what we look for.
What does an incident response engagement with IronSights involve?
An engagement with a defined scope, led by a senior responder, across six steps: mobilise and triage, isolate and contain, investigate the kill chain, eradicate and remediate, recover and restore, and report. We commit to same-day mobilisation, a single senior point of contact, defined deliverables and liaison with the ACSC and police on your behalf. We do not promise decryption, because no honest responder can.
The bottom line
Paying a ransom is a decision to make with clear eyes, legal advice, and only after the recovery options have been properly assessed, not a reflex in the first frightening hour. In our experience, organisations that pause, preserve, and bring in the right help recover far more often than the panic of the moment suggests. If you are in the middle of a ransomware incident now, our team can help you work out what is recoverable and what your obligations are. You can read more about how we recover data from partially encrypted files on our ransomware data recovery page, and about our wider response work on our incident response page.
