Should You Pay the Ransom? The Legal, Insurance, and Practical Answer
When ransomware has already locked your systems, the question stops being theoretical fast: pay and hope for a working decryptor, or refuse and rebuild from backups. Neither path is risk-free, and the honest answer depends on factors most business owners have never had to weigh before — legal exposure, insurance requirements, and whether the attacker will actually hold up their end.
The Legal Risk: OFAC Sanctions Exposure
The U.S. Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned several ransomware groups and the cryptocurrency wallets tied to them — paying a sanctioned entity can expose your business to civil penalties regardless of whether you knew the group was sanctioned at the time. Before any payment is made, a sanctions screening of the demanded wallet address (your insurer or a ransomware negotiation firm will typically handle this) is a non-negotiable step, not an optional precaution.
Your Cyber Insurance Policy Likely Controls This Decision
If you carry cyber insurance, your policy almost certainly requires insurer pre-approval before any ransom payment, and may mandate using the insurer’s approved incident response vendors — paying without that approval can jeopardize coverage for the entire incident, not just the ransom itself. See our cyber insurance claim guide for the notification sequence, and our small business cyber insurance guide if you’re evaluating whether your current policy actually covers ransom payments at all — some explicitly exclude it.
| Factor | Favors paying | Favors not paying |
|---|---|---|
| Backups | Missing or also encrypted | Clean, tested, recent backups exist |
| Data sensitivity | Low (encryption-only, no theft) | Data was also stolen — paying doesn’t guarantee deletion |
| Downtime cost | Extremely high per day | Manageable rebuild timeline |
| Decryptor reliability | Known-good decryptor for this strain exists | Group has history of broken/no decryptors |
Decryptor Reliability Is Genuinely Uncertain
Paying doesn’t guarantee a working decryptor — some ransomware groups provide reliable tools because their business model depends on a reputation for honoring payment, while others simply disappear, provide a broken tool, or demand a second payment. Negotiation firms and your insurer’s incident response team often have current intelligence on a specific group’s track record that you won’t find through a general search.
The Re-Extortion Problem
Paying once doesn’t close the door — a business known to have paid is a more attractive future target, and some groups explicitly re-extort the same victim weeks or months later, sometimes with the same stolen data. This risk compounds when the underlying vulnerability that let the attacker in wasn’t actually fixed, not just the encrypted files restored.
Report It — Regardless of the Payment Decision
Filing a report with the FBI’s Internet Crime Complaint Center (IC3) is a parallel step, not an alternative to negotiating or paying — federal guidance leads with reporting precisely because it happens alongside the payment decision, not instead of it. Reporting doesn’t commit you to anything and can sometimes connect you with intelligence on the specific group’s behavior, including whether its decryptors are known to work.
What If You’ve Already Decided Not to Pay?
Our ransomware response guide covers the full before/during/after sequence if you’re rebuilding from backups instead — including the incident response and law enforcement notification steps that apply either way, regardless of the payment decision.
Bottom Line
The FBI and CISA both generally discourage paying ransoms, but the real-world decision involves your insurer, legal counsel, and a sanctions check before anything else happens — this is not a decision to make alone under pressure, and it’s not legal advice. Loop in your cyber insurance carrier and an attorney immediately once ransomware is confirmed.
Official sources: CISA — StopRansomware.gov, U.S. Treasury OFAC — Ransomware Advisory.
