Home / Blogs

Should You Pay Ransomware Demands?

In 2016, ransomware became an increasingly serious problem for small and medium businesses. Ransomware has proven a successful revenue generator for criminals, which means the risk to businesses will grow as ransomware becomes more sophisticated and increasing numbers of ethically challenged criminals jump on the bandwagon.

Every business must take steps to protect itself from ransomware, but talking about prevention doesn’t help ransomware victims decide whether to pay to get their data back.

It’s an unpleasant position in which to find oneself. No-one wants to pay criminals for access to their own data, but nor do they want to permanently lose access to information vital to their business.

To pay, or not to pay? As you might expect, there’s no definitive answer, but we can think through some of the factors that should influence your decision.

The FBI’s position on ransomware payments is straightforward: don’t pay. The FBI believes paying doesn’t guarantee access to the encrypted data, that it “emboldens” criminals to target more organizations, and that it encourages more criminals to join the ransomware industry.

All of that is true, but business owners are understandably more interested in getting their data back now than whether paying encourages future attacks.

Nevertheless, before paying, business owners should consider that by paying, they paint a target on their back. Criminals will bleed a victim dry if they’re able. If you make a payment, you show the attacker that you’re the sort of person who pays, and that can only encourage the attacker to find out how much more they can extort.

If you choose to pay, you may or may not receive the keys to unlock your data. There is no guarantee that the keys will ever be delivered. But, counter-intuitive as it may sound, the ransomware model is based on trust. Victims have to trust that attackers will release their data—otherwise there’s no incentive to pay.

In most cases, people who pay get their data back. In fact, the largest ransomware operations provide excellent customer service. They will help you pay and decrypt the data.

Ultimately, your decision to pay should be predicated on a simple calculation: is the data I stand to lose and any future risk caused by paying worth the price being asked?

The best way to avoid paying is to make sure that you never become the victim of a ransomware attack in the first place. That might seem like a truism, but it’s surprising how many business owners don’t take the simplest steps to keep their data safe.

Educating employees about ransomware and phishing should be a high priority, but the single most important action a business owner can take is the creation of regularly updated offsite backups.

Ransomware is only effective if it deprives the business of data; if that data is duplicated in a place the attackers can’t reach, they have no leverage and you won’t have to pay them a cent.

By Rachel Gillevet, Technical Writer

Filed Under


Do you think that a company not Alex Tajirian  –  Jan 11, 2017 10:39 AM

Do you think that a company not smart enough to have data backups would have the necessary analytical skills to do a cost-benefit analysis of pay/no pay? Should they immediately get the FBI involved?

Comment Title:

  Notify me of follow-up comments

We encourage you to post comments and engage in discussions that advance this post through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can report it using the link at the end of each comment. Views expressed in the comments do not represent those of CircleID. For more information on our comment policy, see Codes of Conduct.

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Co-designer of the TCP/IP Protocols & the Architecture of the Internet




Sponsored byDNIB.com

Threat Intelligence

Sponsored byWhoisXML API


Sponsored byVerisign

New TLDs

Sponsored byRadix

Brand Protection

Sponsored byCSC

IPv4 Markets

Sponsored byIPv4.Global

Domain Names

Sponsored byVerisign