Qantas chairman John Mullen says large organisations, like his former company Toll Group, should never pay ransoms to cybercriminals on principle, but that smaller companies must have the leeway to do so or risk oblivion.

Mr Mullen told The Australian Financial Review Cyber Summit he had been faced with the prospect of paying a ransom twice, and refused both times. Once was as the chairman of Toll when hackers crippled its systems in 2020 and then when a private maritime museum run by his Silentworld Foundation fell victim to a ransomware attack.