Mandatory ransom payment reporting
An obligation on a victim to report to the authorities, within a short deadline, the ransom it paid, introduced in Australia in 2025 and planned in the United States, which makes visible payments the market knew only from its own files.
Mandatory ransom payment reporting requires an organization that paid, or on whose behalf a third party paid, to report it to a public authority within a set deadline, with information on the attack, the amount, the cryptocurrency used and exchanges with the attackers. It says nothing about whether the payment is lawful, which is governed by other rules, but it removes its opacity. Three effects matter for insurance. Authorities gain a statistical view of payments, until now known only to insurers, negotiators and exchanges, which feeds sanctions and seizures. An insurer that reimburses or advances the ransom must make sure the report was filed on time, or it takes part in an irregularity. And the loss acquires an administrative trace that can later be matched with a sanctions designation or an attribution to a state. The obligation thus sketches an intermediate regime between freedom to pay and prohibition, and in France it combines with the prior complaint requirement.
Since May 30, 2025, Australia's Cyber Security Act 2024 has required businesses with turnover above three million Australian dollars to report any ransom payment to the national cyber security agency within 72 hours. In the United States, CIRCIA provides a 24-hour deadline for critical infrastructure operators.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.