Should you pay a ransomware ransom?
Short answer
Law enforcement agencies, including the FBI and CISA, advise against paying. Payment does not guarantee working decryption or deletion of stolen data, it funds further attacks, and in some cases paying sanctioned groups is illegal. Report the attack and get professional incident response help.
The details
The decision is ultimately the victim’s, often made with legal counsel and insurers. Reporting to authorities can give access to known decryptors and intelligence about the group.
Terms explained
- Ransomware
- Ransomware is malware that encrypts or steals data and demands payment to restore access or prevent publication.
- Incident response
- Incident response is the organized process of preparing for, detecting, containing, eradicating and recovering from security incidents, then learning from them.
Sources
Related questions
Related Guides
GuideIncident Response
How to Backup Data on Windows 11: A Step-by-Step Guide
Learn how to backup data on Windows 11 using built-in tools, external drives, and isolation practices to defend against hardware failure and ransomware.
Read more GuideIncident Response
Triage and Containment of SSH Brute Force Attacks from Linux Logs
Practical techniques for parsing /var/log/auth.log, aggregating attacking subnets, and verifying whether key-only policies prevented breach.
Read more GuideIncident Response
The Binance Hack Timeline: How a 93-Cent Transaction Drained $6.3 Billion
A minute-by-minute account of the October 2026 Binance hack: the EIP-7702 sweep, the freeze race, the "one laptop" explanation, the North Korea attribution and where the money is now.
Read more GuideSmall Business Security
10 Small Business Cybersecurity Tips to Reduce Risk Fast
Protect your company with ten practical small business cybersecurity tips. Implement MFA, patch software, secure Wi-Fi, and build backups that work.
Read more