Summary

  • The Australian Cyber Security Centre's reporting page sends cybercrime to police, cyber security incidents and vulnerabilities to ASD's ACSC, and ransomware or cyber extortion payments to the Department of Home Affairs under section 27 of the Cyber Security Act 2024.
  • The protection offered to the reporter on that same page appears only as the heading "How ASD protects your privacy: limited use obligation", and the text captured on 13 November 2026 states no perimeter, no reporting period and no penalty.

The public entry point for a cyber incident in Australia does not ask what happened. It asks which of several things happened, because each answer belongs to a different body.

Read the Australian Cyber Security Centre's reporting page as an instrument rather than a form and its logic becomes plain. Cybercrime goes to police. Cyber security incidents and vulnerabilities go to ASD's ACSC. Ransomware or cyber extortion payments go to the Department of Home Affairs. That division is what the Centre's own pages set out, captured for this account on 13 November 2026 in provider-reported excerpts of the page text rather than in a complete archive of the pages.

The payment corridor carries a statutory citation, and the page's own wording is worth reading slowly:

Report a ransomware or cyber extortion payment to the Department of Home Affairs. Under section 27 of the Cyber Security Act 2024, a reporting business entity has an obligation to report to the Government if you have made or are aware another entity has made on your behalf, a ransomware or cyber extortion payment.

The trigger is not only the payment an organisation made. It is also awareness that another entity made one on the organisation's behalf. An entity that never moved a dollar to an extortionist can sit inside that obligation because an insurer, an adviser, a managed service provider or a parent company settled the demand. The sentence reaches upward, into the part of the organisation that learns things late and documents them worse.

The phrase doing the definitional work is "reporting business entity", and the page does not define it. The addressee is "the Government"; the page names the Department of Home Affairs as the corridor. Neither of those is a drafting quibble. They decide whether your organisation is inside the duty and where its record ends up.

Now the other half of the transaction. On the same page, under the same structure, the protection a reporter is asked to trust appears as a heading: "How ASD protects your privacy: limited use obligation".

A heading is a category, not a perimeter. A perimeter answers four questions. What information is covered — the incident report, the payment report, the attachments, the names of staff, the forensic timeline? Which uses are permitted? Which are excluded — onward sharing to another regulator, an enforcement file, a public statement? What retention applies, and who may authorise a use outside the list?

None of those answers appears in the text captured. That is a bounded finding about two pages as they stood on 13 November 2026, and it stops there: the wording is nowhere in what was read, which is not the same as nowhere at all.

Across the Centre's submit-a-report page and its report-and-recover page as captured on 13 November 2026 (the Centre's own reporting page, its report-and-recover page), the text states no period or deadline for the section 27 report, no penalty for failing to report, no definition of "reporting business entity", and no perimeter for the limited use obligation. The enacted text of the Cyber Security Act 2024 was not part of the material read here, so nothing below characterises what the Act contains beyond the one citation the page itself prints. Silence on a guidance page is not silence in a statute, and the honest reading of a heading is that the argument has not been made yet.

That distinction matters because of who is being reassured. The body the public calls about an incident is ASD's ACSC. The body the payment duty is described as running to is the Department of Home Affairs, through the Government. One page, two destinations, two portfolios. A board that treats the page as a single front door will assume a single record, a single protection and a single accountable official. The page is a surface over three corridors, and the accountability has to be built across all of them.

What a reporter should have in writing before the material goes over the wall is unglamorous and short. The citation, and the operative words rather than the summary. A statement of whether this entity is a "reporting business entity" and on what basis. The period, and the moment it started running. The penalty, and whether it is a criminal offence or a civil penalty. And, for the protection: the permitted uses, the excluded uses, the retention rule, and the office-holder who can open the door wider.

Ask for those and the heading turns into a commitment somebody has to own. Accept the heading and the perimeter is settled later, by whoever is holding the file.

The Australian Cyber Security Centre already has one article attached to it in the BTW directory. This account does not characterise that earlier piece, because searches in this run did not locate it. What is different here is the object of attention: not the Centre as an institution, but the intake page as an instrument that decides where a bad night gets filed.

The Centre's page does its job. It tells you which door to walk through. It does not yet tell you what happens to what you carry in. Until an office-holder, a retention rule and an exclusion list are printed beside that heading, the organisation doing the reporting is absorbing the uncertainty as well as the incident.