Should we pay the ransom after a ransomware attack?

Start with an honest fact: plenty of organisations pay. Sophos's State of Ransomware 2026 surveyed 2,158 IT and security leaders in 17 countries and found that 48% of organisations whose data was encrypted paid the ransom. Cybereason's 2024 study of 1,008 enterprises with at least 500 employees that had been held to ransom put the figure higher still, with 84% saying they had paid.

The reasons respondents gave are practical ones: no usable backups, fear of losing business, threats to publish sensitive information, an attack landing on a holiday or weekend when staff were short, and a sense that paying was simply the fastest way out. For a company whose production line has stopped while customers chase deliveries, that pressure is real, and we will not pretend otherwise.

But why people pay and whether paying solves the problem are separate questions. Almost every reason above rests on one assumption: after payment the data comes back, the leak stops and the incident is over. The sections below test that assumption against public evidence.

Our own position is clear - we do not pay ransoms, negotiate on a client's behalf, or buy or transfer cryptocurrency - but the decision is yours. Our job is to make sure it rests on facts.

Not necessarily, and the gap is wider than most people expect. The FBI puts it plainly: paying does not guarantee you will get any data back, and some victims who paid never received a decryption key.

Even with a decryptor in hand, problems are common:

• The decryptor can be broken. In December 2019 Emsisoft disclosed that the updated decryptor Ryuk supplied to paying victims contained a calculation error: on partially encrypted files larger than 54.4 MB it cut off one byte too many at the end. VHD and VHDX virtual disks and database files such as Oracle's keep important information in exactly that position, and failed to load after decryption.
• What comes back is incomplete. In Cybereason's 2024 survey only 47% of companies that paid got their data and services back uncorrupted.
• Decryption takes time as well. The tool has to be run against every affected host and data set. Decrypting, verifying and bringing back dozens of hosts and terabytes of data is still work the organisation must organise, so downtime does not vanish because a payment was made.

The other promise is deletion of stolen data. In February 2024, after Operation Cronos led by the UK National Crime Agency took control of LockBit's infrastructure, the NCA stated that some of the data on LockBit's systems belonged to victims who had paid - evidence that payment does not guarantee deletion, whatever the criminals promised.

Then there is the idea that paying ends it. In the same Cybereason survey, 78% of companies that paid were held to ransom again, and 63% said they were asked to pay more the second time. Payment closes no entry point; it only proves the organisation will pay.

What follows summarises published rules and official guidance. It is not legal advice; rely on the competent authorities and your own counsel.

In mainland China. On 6 February 2026 the People's Bank of China and seven other authorities issued the Notice on Further Preventing and Handling Risks Related to Virtual Currencies (Yinfa [2026] No. 42), which repealed the 2021 notice (Yinfa [2021] No. 237). It restates that virtual-currency business activities in China, including exchange between fiat and virtual currency, are illegal financial activities and strictly prohibited; that financial institutions, including non-bank payment institutions, must not provide account opening, fund transfer or clearing and settlement services for them; that civil acts by any organisation or individual investing in virtual currency contrary to public order and good morals are void; and that fraud, money laundering and other crimes involving virtual currency are to be pursued under the law.

The notice is not written about ransoms, but the practical meaning is clear. Turning yuan into bitcoin or USDT to pay a ransom can realistically only happen through prohibited exchange channels or overseas platforms, with no recourse if anything goes wrong. State-owned entities, listed companies and regulated sectors usually have their own rules on expenditure, disclosure and incident reporting, and workarounds such as an individual advancing the money for later reimbursement can create a bigger problem at audit. The Ministry of Public Security's cyber security bureau also lists not paying a ransom lightly among the three don'ts in its September 2026 advisory.

US nexus. The US Treasury's Office of Foreign Assets Control (OFAC), in its updated advisory of 21 September 2021, states that the US government strongly discourages paying ransoms. Payments to sanctioned persons or comprehensively embargoed jurisdictions can violate sanctions, and OFAC may impose civil penalties on a strict liability basis - a person can be liable without knowing the recipient was sanctioned. The advisory names financial institutions, cyber insurers and digital forensics and incident response firms that facilitate payments on behalf of victims as also at risk, and treats a self-initiated, timely and complete report to law enforcement, plus cooperation, as mitigating factors. OFAC has designated a number of ransomware-linked individuals and groups, and virtual currency exchanges that moved ransom proceeds, such as SUEX in September 2021.

UK nexus. The Office of Financial Sanctions Implementation's guidance on ransomware and financial sanctions (updated January 2026) states that the UK government does not condone paying ransoms; that making funds available to an asset-freeze target through a ransom is a breach of financial sanctions and a serious criminal offence that can carry a custodial sentence or a monetary penalty; and that ransomware payments are unlikely to be considered appropriate for an OFSI licence. Where victims report through the national cyber incident portal, voluntarily disclose to OFSI and cooperate with law enforcement, OFSI and the NCA are more likely to resolve a case without a monetary penalty or criminal investigation.

Foreign-invested companies in China, and any business with an overseas parent, US dollar settlement or a US-connected party, should bring legal and compliance in before any conversation about payment begins.

Some services market themselves as ransomware decryption or recovery without paying, but what they actually do is contact the attackers on the victim's behalf, pay the ransom, obtain the decryptor, and bill the victim for the ransom plus a fee.

This is documented, not speculation. In May 2019 the US non-profit newsroom ProPublica investigated two US data recovery firms that claimed to decrypt with their own technology. Proven Data Recovery's CEO acknowledged that paying attackers was standard procedure, and ProPublica traced four of its ransom payments to SamSam on the blockchain - wallets the US Treasury later placed under sanctions. The other firm, MonsterCloud, told visitors not to pay the ransom, yet quoted one client US$25,000 where the underlying ransom was about US$7,000. In China, the first of the three don'ts in the Ministry of Public Security's September 2026 advisory is not to trust online decryption tools or decryption agents, to avoid being defrauded twice.

A broker that pays on your behalf passes every risk in the previous sections straight through to you. The decryptor can still be broken, deletion is still unverifiable and the money still reaches the attackers - only at a higher price, and possibly without you knowing a ransom was paid at all. Useful tests:

How a test decryption is run matters. Attackers themselves offer to decrypt a few files for free, so a provider that decrypts a handful of your samples has only shown it can get the key - not that it did not pay for it. Stronger evidence: you choose the files, including large files and databases; the provider explains how the decryption works; and the contract states that no contact will be made with, and no payment made to, the attackers. A provider willing to sign that clause at least has confidence in its own technical route.

Not paying does not mean giving up on the data. Recoverability varies with the family, version, encryption method and state of backups, and the usual paths are:

• Public decryptors. For a small number of families, leaked keys, law enforcement seizures or implementation flaws have produced decryptors published by police agencies or security vendors. They usually work only for specific builds and must be matched before use.
• Backups, snapshots and off-site copies. In Sophos's 2026 survey, 66% of organisations whose data was encrypted recovered through backups. Storage and hypervisor snapshots are often administered separately from the backup system and are frequently overlooked.
• Database and virtual disk repair. Many families encrypt only the start of large files or encrypt intermittently, leaving most data pages and disk regions intact and readable business data extractable - see database encrypted by ransomware.
• Remnants and downstream data. Remnants in unallocated space, copies on staff endpoints, and the same records in connected systems.

Which path works, and how far it gets you, can only be established by assessing read-only copies; the overall reasoning is in can encrypted files be recovered.

Recovery is half the job. The other half is finding the entry point, removing back doors and rotating every credential - otherwise you can be encrypted again whether or not you paid. See why ransomware keeps coming back and our incident response service.