4 Work with industry to break the ransomware business model The problem we face Ransomware is one of the most disruptive cyber threats in the world today. Ransomware and cyber extortion attacks have demonstrated their capacity to disrupt the lives and livelihoods of Australians. Malicious cyber actors are developing new technologies to automate ransomware attacks. ‘Ransomware-as-a-service’ products can be purchased on the dark web, making it easier than ever for criminals to steal valuable data. Ransomware incidents are under-reported, limiting our national understanding of their true impact on the economy. Reduced visibility of ransomware attacks can impact incident response and harm mitigation efforts. Poor visibility of threats may also contribute to underdeveloped business risk models. The ransomware business model is fuelled by payments made to cybercriminals, with cryptocurrency transactions enabling malicious actors to anonymously profit from extortion claims. Paying a ransom does not guarantee that sensitive data will be recovered. It also makes Australia a more attractive target for criminal groups. Throughout consultation, we have heard that businesses feel alone when tackling ransomware. Business leaders do not have clear guidance on how to prevent and respond to cyber extortion. How the Government will take action To make Australia a hard target for ransomware, we must disrupt the ransomware business model. The Australian Government will take strong action to prevent cybercriminals from profiting from attacks on Australian citizens and businesses. Under this initiative, the Government will: 1. Enhance visibility of the ransomware threat We need early warnings of ransomware attacks to enable the Government to provide the right support at the right time. We also need to build an improved picture of the ransomware threat so that we can develop appropriate responses. To stay ahead of the threat, we will co-design with industry options to legislate a no-fault, no-liability ransomware reporting obligation for businesses. Pending design, anonymised reports of ransomware and cyber extortion trends could be shared with industry and the broader community to help us take steps to build our national resilience against cybercrime. 2. Provide clear guidance on how to respond to ransomware Consistent with our Counter Ransomware Initiative (CRI) commitment, the Australian Government continues to strongly discourage businesses and individuals from paying ransoms to cybercriminals. There is no guarantee you will regain access to your information, or prevent it from being sold or leaked online. You may also be targeted by another attack. 22 2023–2030 Australian Cyber Security Strategy