Should an organisation pay a ransomware demand?¶
The practical answer¶
Whether to pay is a legal, operational, ethical and risk decision, not a purely technical one.
The key evidential caution¶
The dangerous assumption is that payment guarantees decryption, deletion of stolen data or an end to the incident.
It does not.
Payment may result in:
Key points¶
- a working decryptor
- a partial or failed decryptor
- further demands
- continued publication
- no response
- sanctions or legal risk
- encouragement of future offending
- evidence and intelligence opportunities
Investigators should avoid making unsupported assurances about outcome.
The organisation should obtain appropriate legal, regulatory, insurance, financial and law-enforcement advice.
Where payment is considered, preserve:
- the demand
- negotiation history
- wallet or account details
- exchange or payment-service records
- authorisations
- decision records
- transaction identifiers
- files or keys supplied afterwards
Evidential limits¶
Do not treat willingness to negotiate as proof that the offender controls the affected systems or data.
Likewise, a successful decryptor does not prove the offender deleted retained copies.
The decision process should be documented independently from the technical investigation.
The decision may also affect other victims and investigations. Payment can fund further offending, create additional transaction evidence or reveal a negotiation and wallet infrastructure. Those consequences should be assessed by appropriately authorised decision-makers rather than assumed by the technical response team.
Where payment could breach sanctions, anti-money-laundering rules, insurance terms or other legal duties, current specialist advice is essential. The investigator’s role is to preserve evidence, explain technical uncertainty and support informed decision-making, not to guarantee the legality or effectiveness of payment.
Operational takeaway¶
Treat payment as a high-risk organisational decision with no guaranteed outcome, and preserve the full legal, financial, negotiation and technical record.