From today, businesses with an annual turnover above $3 million who make a ransomware payment must report it within 72 hours. This is all about ensuring the government is able to better assess the threat landscape and disrupt the ransomware business model.