Should You Pay the Ransom? What to Weigh

Within hours of an attack, someone will ask whether it would be simpler to pay. It is a reasonable question and it deserves a straight answer rather than a lecture. We do not negotiate with attackers, we do not make this decision for organisations, and nothing here is legal advice. What we can set out is what paying tends to deliver in practice, what it does not, and the assessment worth doing first — because most organisations are asked to decide before they know what they still have.

The decision looks completely different depending on whether the answer is 'nothing' or 'most of it'. That is a question of fact, and it can usually be answered within a day or two. It means checking whether any backup copy survived, including ones people have forgotten; whether snapshots exist on storage or at a cloud provider; and, importantly, how much of the encrypted data is actually encrypted.

That last point surprises people. Attackers under time pressure frequently encrypt only part of each large file, because fully encrypting terabytes is slow and noisy. Large database files, mail stores and virtual machine disks are often damaged at the head rather than throughout. How much remains readable is established by examining the files, not by assuming. An organisation that discovers it can recover most of its data is in a very different negotiating position than one that has assumed the worst.

Paying buys a decryption tool, not a recovery. The tool still has to be run across every affected system, and that takes time that is frequently comparable to restoring from backup. Attacker-supplied decryptors are often poorly written, slow, and prone to failing partway through large files. Some data typically does not come back even when the key is genuine.

Where data was also stolen, which is now the norm rather than the exception, paying does not undo the theft. What is being purchased is a promise to delete copies, from people who have already demonstrated what their word is worth. The data may still be leaked, sold or used later, and any regulatory notification obligation exists regardless of whether a payment was made.

Payments to sanctioned entities are prohibited in a number of jurisdictions, and some ransomware groups are sanctioned. Reporting obligations, and in some places restrictions on payment itself, differ by country and by sector. This is genuinely a question for your lawyers and your regulator, not for your IT team or for us.

If you hold cyber insurance, involve the insurer before doing anything, including before paying and before beginning recovery. Policies commonly require notification and the use of approved responders, and acting first can affect cover. Insurers also tend to have experience of what actually happens in these cases.

Do not delete encrypted files, do not reformat the affected storage, and do not wipe and rebuild the first compromised machine you find. Encrypted files are the raw material for any recovery that does not involve the attacker, and the compromised systems hold the evidence of how entry was gained. If that entry point is not found and closed, a restored environment is simply a fresh target. Ransom notes, attacker communications and logs should be kept as well, for insurers and for any investigation.

Organisations that pay are known to have paid, and the same access routes frequently remain open. Repeat incidents, sometimes by the same group and sometimes by another that bought the access, are common enough to factor into the decision. Payment addresses the encryption, not the weakness that allowed it.

For some ransomware families, keys have been published, seized by law enforcement or recovered through flaws in the encryption, and legitimate free decryption tools exist through initiatives such as No More Ransom. This applies only to certain variants, so identifying which family you are dealing with is worth doing early. Be cautious of services that claim they can decrypt anything: some are simply paying the attacker on your behalf and adding a margin.

Our role is the technical one: establish what is recoverable from the encrypted data, backups and snapshots, and say plainly what looks realistic before chargeable work begins. If the honest answer is that paying is the only route to some of the data, we will say so rather than take on work that will not succeed. If a substantial recovery looks possible without paying, that is worth knowing before a decision is made under pressure.