How much does ransomware decryption cost, and how long does recovery take?

A quote given before we understand the environment is meaningless, so we do not quote over the phone. "Ransomware decryption" can mean files on a few office PCs or an entire virtualization platform, and those are not the same order of magnitude. These are the main drivers of cost and duration:

Two further points. First, whether decryption is possible depends on the family and version, not on how much you pay. Free tools collected by No More Ransom and similar projects cover specific builds of some families only; for most mainstream families there is no way to break the encryption unless keys are exposed, and the budget goes on backup restoration and data repair instead. Second, the encryption method shapes repair effort. SentinelLabs research from September 2022 documented BlackCat, PLAY, Black Basta and others advertising or using intermittent encryption - encrypting only part of each file for speed. That leaves room to repair large files, but coverage has to be mapped by entropy analysis first, and mapping large databases and virtual disks takes time in itself.

Our process has three stages, each explained before it starts:

1. Initial read (free). Send the ransom note text and the appended extension and we tell you which family it is likely to be, whether a public decryptor exists, which recovery paths are worth checking, and what to do and avoid right now.
2. Full recoverability assessment. This needs access to the environment, read-only imaging, and trial repairs and path validation on copies. Whether and how it is charged depends on the scope of work; we state that clearly and get your confirmation before starting, and never do the work first and discuss it afterwards.
3. Written quotation and implementation. After assessment we issue a written quotation stating scope, deliverables and expected timing, and work starts only once both sides confirm. Changes in scope are handled through a written change order.

The assessment explains what can be recovered, what cannot, and why. Where the conclusion is that data is unrecoverable, we do not continue with recovery work that has no substantive prospect of success.

Whichever provider you use, check these items on the quotation:

• Scope: which hosts and systems, to what degree, and whether forensics and hardening are included.
• Deliverables: a recovered-data manifest, verification checklist, operation log, forensic report.
• Timing: ranges by stage, not a vague "as soon as possible".
• Acceptance: what counts as recovery complete, and how confirmed losses are listed.
• Payment milestones and method: corporate settlement and whether invoices are issued.

Our payment milestones, methods and invoicing follow the contract or quotation and are settled through corporate channels. We do not accept cryptocurrency and provide no form of ransom payment. Family identification and assessment findings are never withheld as leverage: you decide whether to engage us after you know what can be recovered, roughly how long it will take and roughly what it will cost. The full stage-by-stage description is on our process page.

It breaks down by stage, and actual timing depends on data volume, environment complexity and the state of backups:

The time goes to three places. First, moving data: every repair happens on copies, and imaging and copying terabytes takes time in its own right. Second, repair and extraction: intermittently encrypted large files are mapped and then extracted segment by segment, and databases are reconciled table by table. Third, verification: putting unverified data into production typically causes longer downtime and harder-to-fix inconsistencies, so we do not cut this step.

What speeds recovery up: early containment; the note and samples ready; usable backups or snapshots (66% of organisations whose data was encrypted recovered from backups in Sophos's 2026 survey); quick business decisions on priority, bringing production and finance systems back first and secondary data in later batches; remote access ready and a contact who can make decisions.

What slows it down: repeated reboots and reinstalls that close off recovery paths; missing logs that make it impossible to confirm whether encryption is still spreading; backups encrypted as well; and restored systems reconnected to production before the entry point is closed, only to be encrypted again. For the order of work on servers see what to do when a server is hit, and if backups were destroyed too see backups deleted or encrypted.

Victims usually look for help when they are most rushed and least informed, which is exactly when sales scripts work best. Be cautious about the following:

• A quote without looking at the environment, or a fixed price over the phone. Without samples, a family or data volumes, any figure is only there to get you on board; watch for extra charges later for "added difficulty" or "databases cost extra".
• Promises of 100% decryption or guaranteed recovery. Whether decryption is possible depends on the family and version, and no provider can guarantee it. If someone claims to crack the newest builds of families with no public tool, ask exactly how.
• A deposit or good-faith fee before samples have been examined, or full payment before the family identification is disclosed. Identification needs only the note and a few samples, so there is no reason to make it conditional on payment. If an assessment stage is chargeable, its scope and deliverables should be set out in writing beforehand.
• Payment only to a personal account or in cryptocurrency. Legitimate providers settle through corporate accounts and issue invoices.
• A price that moves with the ransom and timing that depends on the other side replying. These are hallmarks of a ransom broker: a decryption service on the surface that in fact contacts the attackers, pays the ransom and adds a margin. In ProPublica's 2019 investigation, the US firm MonsterCloud quoted one client US$25,000 where the ransom was about US$7,000, and China's Ministry of Public Security warned in September 2026 against trusting online decryption tools or decryption agents to avoid being defrauded twice. The risks are the same as paying the ransom yourself; how to tell the difference is covered in should we pay the ransom.

One more trap is easy to miss: giving the original disks to several providers to try while you compare prices. Every attempt on the original can write data and overwrite remnants, until nobody can repair it. Comparing providers is fine - but give them only the note, samples and a description of the environment, and keep the original disks read-only.