Should you pay a ransomware demand? What UK and US agencies say

Part of the guide Incident response plan: what to write down

Should you pay a ransomware demand?

Paying a ransomware demand is not encouraged by law enforcement in the UK. The National Crime Agency and the NCSC both say law enforcement does not encourage, endorse or condone paying.

UK sanctions guidance says the UK government does not condone ransomware payments. Guidance from Counter Ransomware Initiative members and insurance bodies strongly discourages paying.

The same guidance accepts that a victim may, in some cases and within local laws, still consider paying. So the decision stays with the organisation. It should rest on the incident's impact and whether paying would change the outcome.

Does paying a ransom get your data back?

Paying a ransom does not guarantee you get your data back. The ICO says there is no guarantee attackers will provide the decryption key. UK sanctions guidance gives examples of decryptors that were not provided or were faulty.

The NCSC says malware is sometimes presented as ransomware, and the files stay locked after payment.

Paying once may not end it. The ICO says double extortion is common, where attackers ask for more money to stop publishing the data. Groups may also return if you have shown willingness to pay.

Is it illegal to pay a ransom in the UK?

Paying a ransom in the UK may not be lawful in some circumstances, for example a payment to a sanctioned entity. UK financial sanctions prohibit making funds available to anyone under an asset freeze, including through a ransomware payment.

Paying, or helping someone pay, a ransom to a sanctioned person risks civil or criminal penalties. The guidance calls these people designated persons.

Reporting matters here. UK sanctions guidance says victims should use the where to report a cyber incident portal as soon as possible. If a payment may have gone to a designated person, report it to OFSI, the UK sanctions office, as soon as practicable.

OFSI generally treats reporting through the portal, and prompt and complete voluntary disclosure, as mitigating factors. With those steps, OFSI and the NCA would be more likely to resolve a case without a monetary penalty or criminal investigation.

Is the UK banning ransomware payments?

The UK has proposed banning some ransomware payments, but these are proposals. The government says that, if progressed, they would be the first specific measures in UK law to counter ransomware.

One limit already exists as policy, not law. The Home Office consultation describes a current principle that central government departments cannot make ransomware payments. The proposed ban would go beyond it.

The first proposal is a targeted ban on payments for the public sector and regulated critical national infrastructure. The other two are a payment prevention regime and mandatory incident reporting.

Under the prevention proposal, victims would tell the government they intend to pay. A payment could be blocked if it could reach sanctioned criminals or break terrorism finance law. If not blocked, it would be the victim's choice, and it would not be approved.

The reporting proposal would mean an initial report within 72 hours and a fuller one within 28 days. The Home Office published the government's response in 2025. It said it will keep developing the ban with industry.

What do US agencies say about paying a ransom?

US agencies also do not encourage paying a ransom. On 20 October 2026, CISA released advisory AA26-293A on SafePay ransomware with partners, including the UK's National Crime Agency.

The authoring agencies say payment does not guarantee files will be recovered. They add that payment may embolden attackers, encourage other criminals and fund illicit activities.

The FBI and CISA urge organisations to report ransomware incidents promptly, whether or not they have decided to pay. This is US government guidance, not UK law.

The advisory says SafePay actors have affected at least 600 victims. When a victim does not pay, SafePay posts the stolen data on its leak website.

What should you check before deciding whether to pay?

Before deciding whether to pay, check the legal position, the technical options and your reporting duties. The Counter Ransomware Initiative guidance says experts can give access to legal and regulatory advice.

Look at the technical options. The guidance says to consider backups, other sources of decryption keys and how long restoring would take. It warns that criminals will try to convince you that paying is the only way back.

If you have cyber insurance, follow the policy's reporting provisions. Reporting to the authorities early can support you.

Personal data needs its own thought. The ICO does not consider paying a ransom an appropriate measure to restore personal data, or an effective mitigation. If you pay to stop publication, the ICO says to still presume the data is compromised.

Paying does not end your data protection duties. The ICO says to report a personal data breach to it within 72 hours of becoming aware of it. That applies unless the breach is unlikely to result in a risk to people. You still need to reduce the risks to people after paying.

What to do

1. Report the incident through the where to report a cyber incident portal as soon as possible.
2. Check your backups. Ransomware targets backups, so keep offline copies apart from your network.
3. Take legal advice on sanctions before any payment is considered.
4. Follow your cyber insurance policy's reporting provisions.
5. If a payment may have reached a designated person, report it to OFSI as soon as practicable.

Common questions

Has anyone gone through the process of paying a ransomware company?

Some victims do consider paying, and the decision is theirs within the law. The National Crime Agency says paying brings no guarantee of getting your data back, and your computer will still be infected.

What happens after you pay a ransomware gang?

There may be no decryption key, and attackers may ask again to stop publishing the data. The ICO says groups may also target you again.

Does the government play any role when a company needs help with ransomware?

Yes. In the UK, sanctions guidance says to use the where to report a cyber incident portal as soon as possible. In the US, the FBI and CISA urge prompt reporting.

Does paying a ransom change your duty to report to the ICO?

No. The ICO does not view paying the ransom as an effective mitigation measure. It says you still need to consider how to reduce the risks to people after paying.

Where next

• After a ransomware or security incident
• After a breach or ICO contact
• Ransomware: what to do in the first hour
• A data breach has happened: who do you call?
• When must you report a personal data breach?
• Incident response plan: what to write down

This is an independent editorial guide, not legal advice.