Picture the worst version of a Monday. Your team logs in to find files locked, systems frozen, and a message on the screen demanding payment in cryptocurrency within seventy-two hours. The clock is running, customers are calling, and every hour of downtime costs money you never budgeted to lose. Somewhere in the chaos, a decision lands on the leader’s desk: do we pay?
It is one of the hardest questions in business, and the honest answer is that it is rarely as simple as yes or no. What follows is a clear-eyed look at what the data actually shows, the risks that hide behind the payment button, and a framework you can use to make the call under pressure. The most important point, though, is the one most people skip: the best time to answer this question is long before an attacker ever forces it.
The short answer, and why it is not simple
Federal authorities are consistent on this point. The US Department of the Treasury, the FBI, and the Cybersecurity and Infrastructure Security Agency all strongly discourage paying ransoms. The reasoning is straightforward. Payment funds the criminal enterprise, it signals that your organization will pay again, and it offers no guarantee that you will recover your data or that attackers will keep their word.
At the same time, leaders in the middle of an incident feel real pressure that policy statements do not: payroll that has to run, clients or patients who need service, contractual deadlines, and the threat of stolen data being published. Pretending those pressures do not exist helps no one. A useful answer has to hold both truths at once, which is why a framework matters more than a slogan.
What the data actually shows about paying
The most comprehensive picture comes from Sophos, whose 2025 State of Ransomware report surveyed 3,400 organizations hit by ransomware over the prior year. A few findings are worth sitting with.
- Nearly half of victims, around 49%, paid a ransom and recovered their data, a slight decline from the year before.
- Across all victims, about 97% of organizations whose data was encrypted eventually got it back, in many cases through backups rather than payment.
- Among companies that did pay, most negotiated the figure down. Sophos found that 53% paid less than the original demand, and in the large majority of those cases the reduction came through negotiation, either directly or with a specialist’s help.
- The average cost to recover from an attack, not counting any ransom, fell to roughly 1.53 million dollars, while the median ransom payment sat near 1 million dollars.
Two lessons jump out. First, paying is not the only path to recovery, and for most organizations it is not even the main one. Second, the demand on the screen is a starting figure, not a final price. Companies that prepare and negotiate consistently pay less, and many recover without paying at all.
The hidden costs of paying
There is no guarantee
A ransom payment buys a promise from a criminal, and nothing more. Decryption tools provided by attackers are often slow, incomplete, or buggy, and some data never comes back even after the wallet is emptied. You are trusting the same people who attacked you to now help you, on their schedule and their terms.
Legal and sanctions exposure
This is the risk many leaders underestimate. The Treasury Department’s Office of Foreign Assets Control has warned that paying a ransom to a sanctioned individual or group can violate federal law, even if you did not know the recipient was sanctioned. That exposure extends to the firms that help you pay, including cyber insurers and incident-response providers. Before any payment is even discussed, qualified legal counsel needs to be at the table.
You become a marked target
Paying tells the broader criminal ecosystem that your organization will pay. Threat groups share and sell that information. A business that pays once often finds itself targeted again, sometimes by the same actors and sometimes by others who simply bought the lead.
Payment does not undo data theft
Modern ransomware frequently involves double extortion, where attackers steal a copy of your data before encrypting it and then threaten to publish it. Paying may unlock your systems, but it does not erase the copy sitting on the criminals’ servers, and you have no reliable way to verify deletion. On top of that, if regulated data was exposed, breach-notification duties under rules such as HIPAA or the FTC Safeguards Rule still apply, whether or not you pay.
When organizations still weigh paying
Despite all of this, there are genuinely hard situations where leaders consider payment, and it helps to name them honestly rather than wave them away. Some involve life-safety systems where downtime is dangerous, as in certain healthcare settings. Others involve organizations whose backups failed or were themselves encrypted, leaving no clean path to recovery. In those moments the decision is not about convenience; it is about survival, and it should be made with legal counsel, an experienced incident-response team, and law enforcement already engaged. The point is not that paying is always wrong. The point is that it should be a deliberate last resort, never a panic reaction in the first hour.
A framework for the first 48 hours
When an attack hits, the quality of your first two days shapes everything that follows. A simple sequence keeps a crisis from becoming a catastrophe.
- Isolate, do not power off. Disconnect affected machines from the network to stop the spread, but avoid wiping systems, which can destroy both evidence and recovery options.
- Call your responders, counsel, and insurer immediately. Your incident-response team, legal counsel, and cyber insurer each shape decisions you should not make alone, including anything involving payment.
- Report to the FBI and CISA. Reporting is free, it can unlock decryption resources, and cooperation is treated as a mitigating factor if sanctions questions ever arise.
- Assess your backups before discussing any demand. If you can restore cleanly, the leverage shifts entirely to your side and the conversation changes.
- Document everything and communicate carefully. Keep a timeline, control internal messaging, and avoid public statements that attackers can use against you.
The only reliable way to win
Notice that every good option above depends on decisions made before the attack. The organizations that recover quickly are the ones that invested in resilience while things were calm. That work is not glamorous, yet it is what turns a potential business-ending event into a manageable disruption.
- Keep layered backups. Follow the 3-2-1 approach with three copies of your data on two types of media and one copy kept offline, and test your restores regularly.
- Turn on multifactor authentication everywhere. Stolen passwords remain one of the most common ways attackers get in, and this single control closes a large share of that door.
- Patch promptly and segment your network. Timely updates and good segmentation keep one compromised device from reaching everything you own.
- Train your team to recognize phishing. A short, regular awareness habit addresses the entry point behind a large share of ransomware incidents.
- Write and rehearse an incident-response plan. Decide in advance who to call and who decides, so the first forty-eight hours run on muscle memory instead of adrenaline.
The takeaway
Should you ever pay the ransom? The most useful answer is to build your business so that you never have to, and so that if you ever face the choice, you make it with clear eyes, good counsel, and clean backups at your back. That is a far stronger position than hoping a criminal keeps a promise.
Alchanis Technical Services provides on-site and remote incident recovery for ransomware and other cyber events, and helps organizations across Augusta and the CSRA put the backups, monitoring, and response plans in place before they are needed. From our base in Harlem, Georgia, we would much rather help you prepare than meet you on the worst Monday of your year.
