When ransomware hits, the ransom note is designed to make you feel there is only one way out. There usually isn’t. Whether to pay is a serious decision that belongs to your leadership, with your legal counsel and insurer. Authene doesn’t make that decision or give legal advice on it. What we do is make sure the people deciding have the facts.
This guide covers the questions worth answering before anyone decides, the risks of paying, and the reporting rules that now apply in Australia.
If you’re dealing with ransomware right now: disconnect affected machines from the network but don’t power them off, check whether your backups are intact and kept separate, and leave any contact with the attackers to leadership, legal counsel and your insurer. Then email response@authene.com.au.
The official position
The Australian Signals Directorate advises against paying ransoms. Payment doesn’t guarantee you will get your data back or that stolen data will be deleted, and it funds further attacks. New Zealand’s National Cyber Security Centre takes the same position.
That doesn’t make the decision simple for a business that can’t operate. It does mean paying should never be the first or only option considered.
Questions to answer before anyone decides
Can you recover without paying?
The most important question. It depends on whether you have backups the attacker couldn’t reach, how recent they are, and how long a restore would take. Sometimes recovery options exist that aren’t obvious at first. Establishing this quickly is one of the first jobs in a response.
Was data stolen as well?
Many ransomware attacks now involve copying data before encrypting it, then threatening to publish it. If data was taken, restoring from backup doesn’t remove that threat, and you may have notification obligations. Knowing what was taken, if anything, changes the conversation.
Is the attacker still inside?
Paying or restoring while the attacker still has access invites a second attack. Containment comes before recovery, whatever the decision on payment.
Who are you dealing with?
Some groups are subject to sanctions, which can make payment unlawful. Your legal counsel will need to consider this.
What does your insurer require?
Most cyber policies have conditions about incidents and ransoms. Involve your insurer early and follow its process.
The risks of paying
- No guarantee of a working decryptor. Tools supplied by attackers can be slow, partial or broken.
- No guarantee data is deleted. Stolen data can be leaked or sold anyway.
- You may be targeted again. Organisations that pay can be seen as willing to pay.
- Legal exposure. Sanctions and other laws may apply.
- It doesn’t fix the problem. You still need to find how they got in and close it.
Ransomware payment reporting in Australia
Since 30 May 2025, the Cyber Security Act 2024 requires certain businesses that make a ransomware or cyber extortion payment to report it to the Australian Signals Directorate within 72 hours. The obligation applies to businesses with an annual turnover above $3 million, and to responsible entities for critical infrastructure assets. It also applies when someone pays on the business’s behalf.
Your legal counsel can confirm whether this applies to you. Separately, data breaches may need to be notified under the Notifiable Data Breaches scheme in Australia or the Privacy Act 2020 in New Zealand.
Where Authene fits
We don’t negotiate with attackers or make payment decisions. We contain the incident, establish what happened, work out whether data was taken and what recovery options exist, and report it clearly to leadership, your insurer and your lawyers so they can decide well.
Read more about our ransomware response, or email response@authene.com.au. A responder replies within 15 minutes, 24/7/365.
Sources
- Australian Signals Directorate, Ransomware: recover from
- Australian Signals Directorate, Ransomware playbook
- Department of Home Affairs, Australia’s Ransomware Action Plan
- MinterEllison, Mandatory ransomware payment reporting obligations in force