Should you pay a ransomware demand?

What paying actually buys

A ransom payment buys a promise from a criminal group. Sometimes that promise is kept: a decryption tool arrives and works. Often it is only partly kept. Decryptors can be slow, crash partway through, or corrupt large files such as databases and virtual machines. Recovery after paying can still take weeks, and businesses frequently end up restoring from whatever backups they had anyway.

Most modern attacks also involve data theft. Paying for the group to delete what it took depends entirely on its word. There are documented cases of stolen data being leaked or sold after payment, or the same victim being extorted a second time. A payment does not undo a privacy breach or your duty to assess it under the Privacy Act 2020.

The wider costs of paying

Ransom payments fund criminal groups and make the next attack more likely, against you and others. Businesses that pay are known to be targeted again, sometimes by the same group through the same unfixed weakness. The payment itself is usually made in cryptocurrency through specialist negotiators, which adds cost and delay. Negotiations can stretch over days while the business stays shut, and attackers sometimes raise their demand once they see a victim is willing to talk. Every hour spent bargaining is an hour not spent rebuilding.

There may also be legal questions. Some ransomware groups are subject to international sanctions, and paying them could create legal problems. Any business seriously considering payment needs legal advice first, and should expect its insurer, if it has one, to be closely involved. Those conversations take time, which is one more reason to settle your position before an attack rather than during one.

Why businesses consider it anyway

The honest reason is desperation. A business with no usable backup, facing the permanent loss of years of client records or the collapse of its operations, may feel it has no alternative. In those circumstances the decision is a business survival calculation, not a technical one, and it is made under enormous pressure, often with attackers imposing deadlines and threatening to double the price. That pressure is exactly why the decision should be thought about in advance. If the only scenario in which you would ever consider paying is the one where your backups fail, the most useful thing you can do today is make sure they cannot fail in that way.

What to do instead of rushing to pay

Do not contact the attackers yourself. Call your insurer if you have cyber cover, your IT provider and an incident response specialist. Report the incident to the National Cyber Security Centre, which may know the group and whether a free decryptor exists. Some older ransomware strains have been cracked by researchers and law enforcement, and decryption tools are published for free.

Have your responders check every backup carefully. Attackers often delete or encrypt obvious backups but miss cloud copies, older snapshots, immutable storage or a drive taken offsite. Even partial backups can sharply reduce what you would need to recover by other means, and email and cloud documents may hold more than you expect. Responders can sometimes rebuild key records from accounting software in the cloud, client copies of documents and email attachments.

If payment is still on the table

If, after all of that, the business is weighing payment, make the decision deliberately. Involve the owners or directors, your lawyer and your insurer. Ask the responder to verify that the attackers can actually decrypt your data, usually by having them decrypt a few sample files. Understand the full cost: the ransom, negotiation, recovery time even with a key, and continuing privacy obligations. Document the decision and the reasons. Whatever the outcome, report the incident, close the entry point and rebuild systems, because a paid-off attacker who still has access is not finished with you.

Making the question irrelevant

The best answer to a ransom demand is not needing to consider it. Backups that are immutable or offline, protected by separate credentials and tested regularly, mean you can say no and recover on your own timetable. EDR that spots and isolates intruders before encryption starts, MFA on remote access and prompt patching reduce the chances of getting there at all.

It is worth agreeing a position now, while calm, and writing it into your incident plan. A board or owner who has already decided not to pay, and invested in backups to support that decision, will handle an attack with much more clarity than one deciding under a countdown timer.