How to Report Cyber Extortion in Australia

A threatening email, a demand for cryptocurrency, or a message claiming someone will share private photos can leave you feeling exposed and pressured to act fast. Knowing how to report cyber extortion can help you regain control, protect evidence and give authorities the information they need to investigate.

Cyber extortion can affect anyone. It may target an individual through sextortion or account takeover, or target a business through ransomware, stolen customer data or a threat to disrupt operations. The right response depends on what has happened, but the first priority is usually the same: stay calm, avoid destroying evidence and get support promptly.

What is cyber extortion?

Cyber extortion occurs when a person uses a digital threat to demand money, information, access or some other benefit. The threat may involve publishing personal material, exposing confidential data, damaging systems, locking files, contacting family members or making false allegations.

A common example is sextortion, where an offender claims to have intimate images or footage and demands payment. In some cases, the offender has obtained images. In others, they may be bluffing after gaining access to an email account or social media profile.

For businesses, cyber extortion often follows a ransomware incident or data breach. Criminals may encrypt company files, steal customer information and demand payment to restore access or prevent publication. Paying a demand does not guarantee that data will be returned, deleted or kept private.

Extortion is a serious criminal matter. However, the immediate steps you take can affect your safety, your ability to recover accounts and the strength of any later investigation or legal response.

What to do before you report cyber extortion

Do not rush to pay, argue with or threaten the person making the demand. Extortionists rely on fear and urgency. They may set a short deadline, use alarming language or contact people close to you to increase pressure.

Preserve what you can without placing yourself at further risk. Take screenshots of messages, emails, usernames, payment demands, cryptocurrency wallet addresses, mobile numbers, web addresses and any files involved. Save original emails where possible, as they may contain technical information useful to investigators. Keep a simple record of dates, times and what occurred.

Do not delete messages merely because they are distressing. You can block an offender after saving the relevant evidence, but consider whether there is an immediate risk that blocking them will affect access to an account or device. If they appear to have access to your email, change the password from a secure device and turn on multi-factor authentication.

If intimate images or videos are involved, avoid forwarding or downloading them further. The aim is to preserve evidence while limiting additional harm and distribution. If you are under 18, or the material involves a child, tell a trusted adult and seek urgent help from police.

If there is an immediate risk

Call Triple Zero (000) if you believe you or someone else is in immediate danger, if an offender has threatened physical harm, or if there is an urgent risk to a child. Cyber extortion can quickly move beyond a screen, particularly where an offender knows your address, workplace or family details.

How to report cyber extortion in Australia

For most online cybercrime matters, you can make a report through ReportCyber, the Australian Government’s online cybercrime reporting service. Provide clear, factual details and attach or retain the evidence you have collected. A report reference number may also assist when dealing with a bank, insurer, platform or IT provider.

You should also report the matter to your local police, particularly where there has been a direct threat, significant financial loss, identity theft, stalking, blackmail involving intimate material, or an ongoing risk to you, your family or your business. In NSW, you can contact NSW Police through a local police station or use the Police Assistance Line for non-urgent matters.

Other reporting channels may be relevant depending on the incident:

• Contact your bank or financial provider immediately if you have sent money, disclosed card details or believe an account has been compromised. Ask about stopping or tracing transactions, securing accounts and replacing cards.
• Report a scam or fraudulent demand to Scamwatch, especially if the incident appears to be part of a broader scam campaign.
• Report image-based abuse to the eSafety Commissioner if someone has shared, or threatened to share, intimate images or videos without consent.
• Report the account, post or message to the relevant social media, email, gaming or messaging platform. Ask the platform to preserve the account and content where appropriate.

Each report serves a different purpose. Police and ReportCyber reports may support an investigation. A platform report may help remove harmful content or suspend an account. A bank report may be time-critical if money has moved. Making one report should not prevent you from making another where it is relevant.

Protect your accounts and devices

Once evidence is preserved, secure the accounts and systems that may have been affected. Start with your email account because it is often used to reset passwords for other services. Use a new, unique password and enable multi-factor authentication. Review recent sign-ins, recovery email addresses, mobile numbers and any rules that automatically forward your emails.

Then change passwords for banking, social media, cloud storage, work systems and any account that uses the same or a similar password. Do not reuse passwords. A password manager can help create and store unique passwords safely.

If you suspect malware, ransomware or unauthorised access to a business network, disconnect affected devices from the network if it is safe to do so. Do not restart, wipe or attempt to decrypt systems before getting specialist IT advice, unless directed by an experienced incident response provider. Those actions can destroy evidence and may make recovery more difficult.

Businesses should also check whether sensitive information has been accessed, copied or exfiltrated. This may include customer details, employee records, financial information, health information or commercially confidential material. Depending on the nature and scale of the breach, notification obligations may arise under the Privacy Act and the Notifiable Data Breaches scheme.

Should you pay a cyber extortion demand?

There is no single answer that fits every case, but payment carries serious risks. The offender may not restore your files, delete stolen data or stop further contact. Payment can also identify you as someone willing to pay, leading to repeat demands or targeting by other offenders.

For an individual facing sextortion, paying often does not end the harassment. Preserve evidence, report the conduct and focus on securing accounts and reducing the offender’s ability to reach you or those close to you.

For a business affected by ransomware, the decision can involve operational, financial, regulatory and legal considerations. It may depend on the availability of backups, the nature of the stolen data, whether critical services are affected and whether the proposed payment creates sanctions or other legal risks. Obtain urgent advice from cyber incident response professionals, insurers and lawyers before making decisions that may have long-term consequences.

When legal advice can help

Cyber extortion often creates several issues at once: criminal conduct, privacy concerns, financial loss, reputation damage and difficult communication with customers, staff or business partners. Legal advice can help you understand reporting options, preserve relevant evidence, assess notification duties and respond carefully to threats.

For business owners, early legal guidance can also assist with incident management, communications and dealing with contractual or regulatory obligations. For individuals, a lawyer can provide practical support where the threat involves intimate images, identity misuse, harassment, family safety or reputational harm.

SDC Lawyers can provide clear, tailored advice for individuals and businesses facing cyber security and cyber extortion concerns. Getting advice early can help you make informed decisions while the facts, evidence and reporting options are still available.

Cyber extortion is designed to make you feel isolated. You do not need to manage it alone. Preserve the evidence, report the threat through the appropriate channels and seek timely support to protect yourself, your family or your business.