How to Decide Whether to Pay a Ransom

Step by step

1. 1

   Stabilize first, decide later

   Before anyone discusses payment, activate your incident response plan: contain the spread, preserve forensic evidence, and stand up a decision group with executive, legal, security and communications leads. Paying is never the first move and rarely an urgent one — the attacker wants time pressure to short-circuit a reasoned decision. Engage law enforcement (in the US, the FBI and CISA) early; they can share decryptors, threat intelligence and context that materially change the calculus.

2. 2

   Prove whether you can restore from backups

   The strongest reason not to pay is a clean, tested recovery path. Confirm you have backups that are offline or immutable, were not encrypted or deleted by the attacker, and actually restore within a tolerable time. Test the restore on isolated infrastructure before concluding it works — untested backups fail far more often than teams expect. If recovery is viable, payment usually is not warranted at all.

3. 3

   Check for a free, legitimate decryptor

   Some ransomware families have known flaws or seized keys, so a free decryptor already exists. Check the No More Ransom project (https://www.nomoreransom.org), a joint effort of Europol, the Dutch police and private security firms, and ask your law enforcement contact. A working free decryptor removes the need to pay entirely. Never run an unverified decryptor from the attacker or an untrusted source on production systems.

4. 4

   Separate encryption from data theft

   Modern ransomware usually also steals data and threatens to leak it ("double extortion"). Understand that paying to prevent a leak buys only a promise from a criminal — there is no guarantee stolen data is deleted, not resold, or not used again later. Treat exfiltration as a data breach on its own track: scope what was taken, and plan the regulatory and customer notifications you likely owe regardless of any payment.

5. 5

   Assess true business and safety impact

   Quantify what the outage actually costs and whether it threatens safety of life — hospitals, utilities and critical services sit differently from a recoverable back-office system. Separate genuine operational necessity from the discomfort of a hard recovery. A high but survivable cost does not justify funding criminal activity; a credible threat to human safety is a different and heavier consideration that still runs through counsel and law enforcement.

6. 6

   Clear the legal and sanctions gates

   Treat payment as legally gated, not as a business judgment you can make alone. The US Treasury’s OFAC issued advisories (2020, updated 2021) warning that facilitating ransomware payments can violate US sanctions if the recipient is a sanctioned person, entity or jurisdiction — and sanctions liability is strict, meaning it can apply even without knowing who you paid. Your insurer, counsel and any payment intermediary all carry exposure. You cannot reliably identify who is behind an attack, which is exactly why this decision belongs with experienced counsel and law enforcement, not with the response team under pressure.

7. 7

   Document the decision and recover either way

   Whatever you decide, record who decided, what evidence and advice informed it, and the controls you checked (sanctions screening, counsel sign-off, law-enforcement engagement). If you do not pay, drive the recovery from backups and rebuild. If payment is pursued as a last resort, it proceeds only through counsel with sanctions due diligence, and recovery, breach notification and hardening still happen in parallel. Capture the lessons so the next incident starts from a stronger position.

Related