Ransomware Insurance in Australia: ACSC & NDB Scheme

Australian ransomware insurance: ACSC and the NDB scheme

Ransomware insurance in Australia is shaped by the Australian Cyber Security Centre (ACSC) and the Notifiable Data Breaches (NDB) scheme under the Privacy Act. The ACSC publishes clear guidance advising Australian organisations against ransom payments, citing that payments fund criminal enterprises and provide no guarantee of data recovery or non-publication.

The NDB scheme requires organisations to notify affected individuals "as soon as practicable" if a data breach is likely to result in "serious harm." Additionally, organisations must notify the Office of the Australian Information Commissioner (OAIC) if 100 or more Australian residents are affected. The OAIC can conduct investigations and enforce remedial action, making breach response a regulatory matter.

• NDB notification requirement. Organisations must notify affected individuals as soon as practicable if the breach is likely to cause serious harm. This is a legal obligation under the Privacy Act.
• ACSC guidance on ransomware. The ACSC provides free incident response support and publishes detailed recovery playbooks for major ransomware families. Many Australian organisations have recovered without ransom payment.
• Ransom payment coverage. Australian insurers increasingly exclude ransom payments entirely or cap them at AUD 500K–AUD 1M, well below typical ransom demands of AUD 2.5M–AUD 4M.
• Business interruption coverage. Most Australian policies cover revenue loss during downtime, with typical waiting periods of 12–24 hours. This is critical for time-sensitive operations.
• Incident response and forensics. Covered; includes legal counsel, crisis management, incident investigation, and access to forensic specialists.

Australian law enforcement and regulatory reporting

The AFP actively investigates organised ransomware groups targeting Australian critical infrastructure. Reporting to the AFP is voluntary but encouraged, as it helps law enforcement understand threat actor tactics and targets. The ACSC works directly with organisations to provide free incident response guidance and threat intelligence.

Australia's approach is collaborative and supportive. Unlike the US with OFAC or the UK with strict FCA timelines, the ACSC provides hands-on assistance. However, the OAIC can conduct post-incident investigations if the breach is serious, potentially resulting in enforcement action.

What voids Australian ransomware coverage

Australian insurers have tightened underwriting significantly. These are the top claim denial reasons:

• No multi-factor authentication. Australian insurers now universally require MFA on email and critical systems. Lack of MFA results in claim denial or severe sub-limitations (AUD 100K instead of AUD 1M).
• Failure to notify "as soon as practicable." The NDB scheme requires timely notification. Delays can void coverage, especially if OAIC would have been notified.
• No immutable or offline backups. If all backups were encrypted or deleted, coverage may be denied for failing to maintain proper backup procedures.
• End-of-life operating systems. Windows 7, Server 2008, or unsupported systems in the network = denial.
• Not using insurer's IR panel. Some Australian policies mandate using pre-approved incident response firms. Using external IR firms may result in partial denial.
• Prior cyber incident within 24 months. A previous breach makes you higher risk; coverage may be denied or heavily sub-limited.

Recent Australian ransomware incidents

Australian ransomware statistics 2025–2026

How to ensure coverage in Australia

• Implement organisation-wide MFA. Email, VPN, RDP, cloud portals. This is now mandatory for all Australian insurers.
• Maintain tested offline backups. At least one backup must be air-gapped (completely disconnected from the network). Test recovery monthly.
• Document your NDB notification process. Know who will notify affected individuals and the OAIC, and in what timeframe. Have a template ready.
• Understand your policy's ransom cap. Many Australian policies cap ransom at AUD 500K. Confirm the exact limit with your broker.
• Know your insurer's IR panel. Get contact details for pre-approved incident response firms. Some policies mandate using them.
• Maintain evidence of security controls. Documentation of MFA, vulnerability scanning, security awareness training, and backup testing will support claims.
• Brief your legal and compliance teams. They must understand the "as soon as practicable" notification requirement to avoid policy exclusions and OAIC penalties.