Should You Pay the Ransom? What Security Experts Actually Recommend.

The official advice from law enforcement worldwide is unambiguous: don't pay ransoms. It funds criminal organizations, doesn't guarantee data recovery, and makes you a target for future attacks. The advice is correct. It's also incomplete.

The Reality on the Ground

When a hospital's patient records are encrypted and lives are at risk, the calculus changes. When a manufacturer faces $10 million in daily losses, the $500,000 ransom starts looking rational. When a law firm's client data is threatened with public release, reputation damage may exceed the payment.

The Expert Consensus

Security professionals increasingly distinguish between 'should you pay' and 'are you prepared not to.' The real advice: invest heavily in prevention and backups so you never face the choice. If you do face it, engage professional negotiators, involve law enforcement, and understand that paying guarantees nothing.

What to do in the first 24 hours

The hours immediately after detection are where most ransomware decisions get locked in. Disconnect affected systems from the network, but do not power them off, because volatile memory often contains keys, command-and-control beacons, and forensic artifacts that investigators from Mandiant, CrowdStrike, or Coveware will want. Notify your cyber insurance carrier before you do anything else: many policies require approved incident responders, and using anyone else can void coverage entirely. Treat the incident as a legal event from minute one and route all communications through counsel.

Before even discussing payment, do a hard inventory of backups. Are they immutable, off-site, and tested? Veeam, Rubrik, and Cohesity all offer object lock features that the attackers cannot encrypt or delete even with domain admin. If you have clean, recent backups and a tested restore runbook, paying rarely makes sense. The 2025 Sophos State of Ransomware report found that organizations with verified backups recovered in roughly half the time of those that paid, and they avoided the second extortion that frequently follows initial payment.

Sanctions risk is the underappreciated reason many lawyers now strongly advise against payment. The U.S. Treasury's OFAC has explicitly warned that paying a sanctioned group, including affiliates of LockBit, Conti, and several Russia-linked operators, can trigger civil penalties even when the victim did not know the recipient's identity. Specialized negotiation firms run sanctions screens before any transfer, but the residual legal exposure is real, and it has grown sharper as enforcement actions multiplied through 2025.

If you do decide to pay, do not negotiate yourself. Professional negotiators routinely cut initial demands by 40 to 70 percent, verify decryptor functionality before transfer, and structure cryptocurrency payments in ways that comply with financial reporting rules. Equally important, they request proof of data deletion, even though everyone in the industry knows that proof is rarely worth the paper it is printed on. Treat any decryptor as untrusted code: rebuild systems from images rather than relying on attacker tooling to restore production.

Whatever path you take, the post-incident phase determines whether you become a repeat victim. Reset every credential, rotate service account keys, and rebuild domain controllers from known-good media. Hunt for backdoors using EDR telemetry going back at least 90 days, since most ransomware crews dwell quietly for weeks before detonation. Publish a transparent incident report to customers and regulators within the timelines GDPR, the SEC's four-day disclosure rule, and state laws require. Quiet handling tends to leak anyway, and trust recovers faster after honesty than after a coverup.

The legal landscape has shifted under your feet

Before you even open a negotiation channel, understand that paying may now be illegal in your jurisdiction. OFAC's 2020 advisory was guidance, but the EU's NIS2 directive, Australia's Cyber Security Act 2024, and the UK's proposed Ransomware Action Plan all move toward outright payment bans for public sector entities and mandatory notification for everyone else. North Carolina and Florida have already banned state and local government payments. A ransomware payment to a sanctioned group like LockBit or BlackCat affiliates can carry strict-liability fines even if you did not know the gang was sanctioned.

This is why no serious response starts without legal counsel on the call within the first hour. Firms like BakerHostetler, Mullen Coughlin, and Crowell & Moring keep 24/7 ransomware practices that loop in OFAC sanctions review, regulator notification timelines, and any payment intermediary licensing requirements. If your insurer or board pushes for a fast decision, slow them down until counsel has cleared the jurisdictional questions. The fines for an illegal payment can dwarf the ransom itself.

Why decryption alone is no longer the point

The decision framework most boards still use, 'how long to restore from backups versus how much to pay for the decryptor,' is roughly five years out of date. Modern ransomware operations are double or triple extortion: encrypt the data, exfiltrate it, threaten to leak it, and threaten to notify regulators and customers. Coveware's 2024 data shows that 76 percent of incidents involved exfiltration alongside encryption. Even if your backups are pristine, the leak threat is now the leverage that drives most negotiations.

That changes the math. Paying for decryption is sometimes optional. Paying to suppress a leak is qualitatively different, because there is no technical way to verify the data was actually deleted. The Conti leaks of 2022 made this brutally clear: gangs lie. They sell stolen data to other criminals after collecting the suppression fee. Once your data is exfiltrated, treat it as breached regardless of payment, and notify accordingly.

How professional negotiators actually structure a call

Firms like Coveware, GroupSense, and Kivu have negotiated thousands of cases and have a remarkably consistent playbook. First, never engage as yourself: use a designated negotiator with a pseudonymous identity and a single channel, usually the threat actor's onion portal or Tox messenger. Second, slow the clock. Most affiliates have quotas and rotation pressure. Asking for proof-of-life decryption tests, sample file recovery, and verification of stolen data buys days of leverage and signals you are organized.

Third, anchor low. Negotiators routinely settle at 20 to 40 percent of the initial demand when the victim demonstrates organized response, partial recovery from backups, and a credible willingness to walk. Showing the threat actor any panic, especially via direct executive contact, is the single fastest way to lose price discipline. This is why bringing the CEO or CFO into the chat is almost always a mistake.

What insurance does and does not cover in 2026

Cyber insurance underwriters have tightened ransomware coverage aggressively since the Colonial Pipeline era. Most policies from Beazley, Chubb, AIG, and Coalition now require pre-approval before any payment, mandate use of an insurer-vetted incident response firm, and exclude payments to sanctioned actors entirely. Sublimits on extortion coverage typically sit at 50 percent of the overall cyber limit, which is a meaningful constraint for mid-market policies that cap at 5 to 10 million USD.

Read your policy before you have an incident, not during. Specifically, confirm whether business interruption coverage triggers from the moment of encryption or only after a waiting period, whether forensic costs are inside or outside the limit, and whether your insurer's panel includes the negotiation firm you would want to use. Companies that skip this step routinely discover, mid-crisis, that they have less coverage than they thought and fewer choices about who responds.

When paying is genuinely the right call

I am not absolutist about this, and neither are most of the responders I trust. Paying is sometimes the right call. Specifically: when patient care is actively at risk and downtime is killing people, as has happened at Universal Health Services and at multiple NHS trusts. When the stolen data includes information that would put named individuals at physical risk, such as a refugee aid organization's client list. When the alternative is permanent business failure and the loss of every job at the company.

What unites those cases is that the harm from non-payment is concrete, immediate, and falls on people who did not choose to take the risk. That is a different ethical category from 'paying is cheaper than rebuilding'. If your decision can survive a deposition and a journalist's review, it is probably defensible. If you would not want it on the front page of the Wall Street Journal, you are probably rationalizing.

The post-incident work that prevents the next one

Whatever you decide on the payment, the response is not over when the systems come back up. CISA's data shows that 80 percent of ransomware victims are hit again within 18 months if root-cause remediation is incomplete. That means identifying the initial access vector, almost always either a compromised VPN credential, a Citrix or Fortinet edge appliance, or a phishing-delivered remote-monitoring tool, and closing it permanently. Rotate every privileged credential. Rebuild domain controllers from clean media. Enable EDR with active response on every endpoint.

Then run a real tabletop exercise within sixty days, with the executive team, legal, comms, and IT in one room, using the actual incident as the scenario. The single biggest predictor of a clean second response is having done the unclean first one with intention. Document what worked, what did not, and what you would do differently. That document, more than any tool purchase, is what shifts an organization from reactive to ready.

And finally, talk about it. Anonymized sharing through ISACs, the Joint Cyber Defense Collaborative, or industry peer groups is how the defensive side actually catches up to the attackers. Quiet payments make the next victim's job harder.