<div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><strong><span>Exclusive:</span></strong><span> A world-first scheme that forces companies to reveal if they have relented to cyber extortion has uncovered a shocking truth - a worrying number of Australian businesses are paying ransoms to foreign criminals.</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>And the Home Affairs Minister Tony Burke has identified Russian crime gangs as a growing cyber ransom threat, as much as scammers based in China, Iran and North Korea.</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>With a view to understanding the extent of ransom payments, it has been mandatory since May 30 for businesses with annual turnovers of more than $3 million to tell the federal government if they pay a ransom.</span></div></div><div><div id="adspot-mobile-medium"></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><strong><span>READ MORE:</span></strong><span> </span><a href="https://www.9news.com.au/national/defence-delivery-agency-new-adf-department-established-richard-marles/1b401b36-7259-4583-ba74-5630a77d1382" rel="" target="" title="Defence agencies scrapped in 'biggest overhaul in 50 years'"><strong><span>Defence agencies scrapped in 'biggest overhaul in 50 years'</span></strong></a></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>In that time, 66 businesses have come forward, although Burke believes there are likely others.</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>"We suspect we're still not getting everybody," Burke told 9News.</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>"This is a really good start, but we still work on the basis that some people are not yet reporting.</span></div></div><div><div class="OUTBRAIN" data-reactroot="" data-src="//www.9news.com.au/national/worrying-number-of-australian-businesses-paying-ransoms-to-cybercriminals/0878b922-ffaa-4216-bab1-91c04d9061fc" data-widget-id="AR_5"></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>'It's not simply a legal obligation to report, it's also completely in their interests."</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>Australia's National Cyber Security Coordinator Michelle McGuinness says paying a ransom is never wise and only feeds the $25 billion-a-year cybercrime industry.</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>But she said the payment of a ransom is not illegal, because in "life and death scenarios" it may be considered the only option by some victims.</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>"There are a small number of scenarios where a system may be connected to a piece of equipment that might be supporting life and death, providing power, providing water," she said.</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>"So there are some unique circumstances where you could envisage that it could have significant impacts if it took you any longer to remediate those systems - so paying might bring you a little bit of speed."</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><strong><span>READ MORE:</span></strong><span> </span><a href="https://www.9news.com.au/national/chinese-naval-flotilla-monitored-adf/58f0b14a-c4b8-4dd1-831d-0ee305138651" rel="" target="" title="Chinese naval flotilla could be bound for Australia"><strong><span>Chinese naval flotilla could be bound for Australia</span></strong></a></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>Melbourne lawyer Cameron Whittfield, who specialises in cyber security at HSF Kramer, said only a small minority of corporates targeted by ransom attacks pay up.</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>He estimated this as less than a third.</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>"Those that pay are probably more likely to pay if they've got an operational or asset integrity issue rather than a data issue, because the data has already left the building by the time that extortion demand arrives," Whittfield said.</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>"And so what you're paying for is something which is relatively intangible, which is basically a commitment from a threat actor to not disclose or delete that data.</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>"Now that can occur whether or not you're critical infrastructure or a hospital or electricity distribution or something similar, or it could be just an everyday business, a small, medium business, which just relies on continuity."</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>9News has been told that ransoms targeting bigger companies typically range from hundreds of thousands to millions of dollars.</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>McGuinness said paying ransoms "just feeds this cycle of criminality".</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>"We're dealing with criminals, so we can't trust that they're going to be honest," she said.</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>"We know they have data. They may give back a copy, but we've also seen criminals and other criminals then exploit further the data.</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>"Those who pay a ransom really illuminate themselves as a target, as being a payer, and so many of them are retargeted and have to pay again."</span></div></div><div class="block-content"><div class="styles__Container-sc-1ylecsg-0 goULFa"><span>Burke said: "A lot of the reports we've had have been from Russian gangs, but no matter what country it's from, they've all got one thing in common: they're criminals, they're not trustworthy, and they're not going to act in people's interests."</span></div></div>