When encryption alone stopped working — because organisations improved backups — groups added data theft. The threat is no longer only that you cannot access your files; it is that your data will be published, sent to your customers, or reported to your regulator. This changes the calculation around payment in ways that are worth understanding before you are in the room.

What payment can deliver

Usually a decryption tool, which typically works, though decryption is often slower and less complete than restoring from good backups. Occasionally a delay in publication. That is the realistic extent of it.

What payment cannot deliver

  • Verified deletion. There is no mechanism to confirm data was destroyed, and copies are routinely retained.
  • An end to exposure. Data has been published after payment, and victims have been re-extorted by the same or affiliated groups.
  • Relief from legal obligations. Notification duties to regulators and affected individuals apply regardless.
  • Protection from repeat targeting. Organisations known to have paid are disproportionately attacked again.

Payments to sanctioned entities carry serious legal consequences in many jurisdictions, and attribution is frequently uncertain during an incident. Several jurisdictions have introduced payment reporting requirements. Your insurer will almost certainly require notification before any payment. Take legal advice before, not after.

Decide the position in advance

The worst time to form a policy on this is at 2am with systems down and a countdown running. Agree in advance: whether payment would ever be considered, who decides, what legal and insurer steps precede it, and who negotiates. Documented in your incident plan, this converts an impossible decision into a process.

What actually reduces the leverage

Immutable backups that a compromise cannot reach, tested restores that make encryption survivable, data minimisation so there is less worth stealing, and segmentation limiting how much one intrusion reaches. Organisations that recover without paying are almost always those that did this work beforehand.