If that assessment is correct and a payment was made, Hachette Australia would be subject to mandatory reporting obligations under the Cyber Security Act 2024 (Cth). As of May 30, 2025, entities carrying on business in Australia with annual turnover exceeding $3 million must report any ransomware payment to the Australian Signals Directorate (ASD) within 72 hours, with civil penalties of up to $19,800 for non-compliance. The Department of Home Affairs moved from an education-first approach to active compliance enforcement from January 1, 2026. Whether any reporting obligation has been triggered in this case is not publicly known, but brokers advising clients in retail, distribution, and logistics should note that non-reporting now carries active enforcement risk.
