This year has seen a wave of high-profile ransomware attacks. The likes of Nike, Airbus, Booking.com and McDonald’s have all faced significant operational disruptions. In many cases, attackers have demanded substantial ransoms to restore access to critical systems and data.
This raises the question, what if this happened to your company? Would you pay to restore your data and operations? It’s a tough decision.
Read on to find out which factors you should consider, why paying the ransom is no guarantee you’ll get your data back, and what to do instead.
Should You Pay the Ransom? Key Factors to Consider
In the event of a ransomware attack, deciding whether to pay is complex and depends on your specific situation and how well-prepared you are. Does your company have a comprehensive Incident Response Plan? What about adequate ransomware protection?
Having a last line of defense and solid backups is your best chance of not paying the ransom.
“I was involved in discussions following a ransomware incident where leadership had to choose between paying and recovering from backups,” reports Pranav Bhatnagar, an AI and cybersecurity researcher. “The deciding factor was preparation.”
In this scenario, because backups were available and recovery procedures had been tested, the organization was able to restore their files and didn’t need to pay. That said, this approach would not have been enough to prevent hackers from selling the company’s data, as threat actors increasingly focus on extortion-based attacks.
Tip: The right tools can make the difference between being forced to pay millions of dollars, and not having to pay a penny. DataDefense from ProLion provides a last line of defense that detects and blocks ransomware attacks in real-time at the file storage level. When attackers strike, you can easily detect the unusual activity and restore the files you need.
How to Decide Whether to Pay the Ransom
Follow these steps to aid your decision-making:
- Verify the data breach
Fake ransomware is becoming more common. Before paying anything, make sure the hack is real. If hackers claim to have your data, ask for proof. Don’t pay based on empty threats alone.
- Understand the type of attack and potential impact
There are many different types of ransomware attacks. Some “only” steal your data and demand a ransom for its safe return, whereas others threaten to leak confidential information.
The damage from so-called leakware attacks can have serious legal implications and damage your reputation, even if you are able to restore your data via other means.
Therefore, understanding the full extent of an attack’s impact is crucial in determining your response.
- Investigate the hacker’s reputation
Hackers are not exactly renowned for being trustworthy, but some are worse than others.
Some ransomware groups are known for not releasing data even after payment, or providing broken keys or decryptors that don’t work. So, make sure you know their history.
It’s also important to check if the malicious actor has been sanctioned. If they are considered a threat to national security interests, paying a ransom to them could be illegal and result in a penalty.
- Check backup availability
Does your company have complete backups of the affected data? Are you able to detect which files are encrypted and restore only the files you need? If so, paying the ransom may not be necessary. Reliable backups can eliminate the need for a decryption key, because you can restore the data yourself (at least in theory).
In practice, backups are often forgotten about, remediation hasn’t been tested, and companies are unable to restore files individually, so there are many cases of backups not being enough to resolve a ransomware attack.
- Review your insurance coverage
If your cyber liability insurance covers ransomware incidents, you might be able to pay the ransom without too much loss to your company.
However, due to the rise in ransomware attacks, insurance providers have started to increase premiums and exclude ransomware payments. In some cases, paying the ransom can invalidate your insurance. Therefore, be aware of the limitations and conditions of your policy.
- Check official guidance from your country’s authorities
Law enforcement authorities generally advise against paying ransoms. If you have been affected by ransomware, you should contact the authorities in your country for further guidance:
United States: Victims of ransomware attacks can report the incident to the FBI, CISA, or the U.S. Secret Service. They only need to report the incident once and all the other agencies will be notified.
United Kingdom: National Cyber Security Centre (NCSC)
Germany: Federal Office for Information Security (German: Bundesamt für Sicherheit in der Informationstechnik, abbreviated as BSI)
Don’t Pay the Ransom: Here’s Why
Whether you ask the FBI, a cybersecurity expert, or pretty much anybody, the usual advice is not to pay the ransom. Let’s explore in detail why paying is usually not recommended, and when to make an exception.
- No guarantees of data recovery or confidentiality
About 40% of organizations who pay the ransom still don’t get their data back. This means that even after paying, there is a very real risk that your data will be lost forever, or worse, leaked. Ultimately, once the hackers have your money, they can do what they want.
- Risk of repeat attacks
Almost 80% of companies who pay are likely to be targeted again. Hackers perceive paid ransoms as a sign of weakness, making your organization a recurring target.
- High cost of ransom payments
Let’s be honest: ransomware payments aren’t cheap. It’s not unusual for ransoms to be in the tens or even hundreds of millions. Ransoms increased substantially in the past year, with the average ransomware demand reaching $3.8M.
- Ransomware fuels terrorism and cybercrime
Paying a ransom funds the broader ransomware industry, supporting cybercrime, terrorism and other malicious activities. Such payments raise significant legal and ethical concerns, as they finance criminal operations and allow global threats to flourish.
Are Ransomware Payments Illegal?
Generally, there is no law prohibiting organizations from paying a ransom. However, there are some exceptions. Legislation in North Carolina, Florida, and Tennessee prevents public sector entities from paying a ransom.
You Might Need to Consider Paying the Ransom, If…
In some specific instances, there are arguments in favor of paying the ransom.
If you urgently need access to your data, don’t have reliable backups, and human safety is at stake, paying the ransom might be your only option.
For example, Change Healthcare paid $22 million to a ransomware group in 2024 to restore services. At the time, it probably seemed worth it to (at least partially) fix one of the biggest ransomware attacks on the healthcare industry of all time, which affected 190M patients.
Nonetheless, the solution remains controversial, and there is a better way.
Prevent Ransomware With ProLion
To be frank, if you’re not prepared for a ransomware attack, there is no ideal outcome. You lose your data if you don’t pay, and there are no guarantees even if you do. The best solution is prevention to avoid a ransomware attack occurring in the first place.
DataDefense from ProLion detects and blocks suspicious activity in real-time. In the event of an attack, the granular restore function enables you to restore the files you need immediately. Learn more about DataDefense, the leading ransomware solution, or book a call to discuss your security needs with our team.
