The email arrives with a deadline, a wallet address and a sample of your own files. Somewhere between the shock and the board meeting, somebody in the room asks the only question that seems to matter: if we pay, does this end?
The honest answer, built up over years of incident data, is that paying sometimes ends the encryption part. It does not reliably end anything else. And in the newest surveys, most victims have stopped paying at all — not out of bravery, but because the arithmetic stopped making sense.
What the payment actually buys
Paying a ransom buys one narrow thing: a chance at a working decryption tool from the people who locked your systems. It does not buy back data that has already been copied. It does not buy a promise anyone can enforce. In the double-extortion pattern that now dominates, the attackers steal data first and encrypt second, so a victim who restores every file can still wake up to a leak-site countdown the following week.
The guidance from United States authorities has not shifted on this point for years. The FBI, CISA and the MS-ISAC state plainly in their joint ransomware advisories that they do not encourage paying, because payment does not guarantee victim files will be recovered. The same advisories add the wider harm: paying may embolden the same actors to target other organisations, encourage new criminals to enter the trade, and fund further illicit activity. They also urge victims to report the incident whether or not a payment is made, because the reporting is what lets investigators connect one victim's case to the next one's.
There is also a legal trap that finance teams discover late. Many large ransomware groups sit on, or move money through, sanctioned networks. A payment routed to a sanctioned entity can create liability for the victim company itself, entirely separate from the attack. Any business seriously weighing payment needs sanctions counsel in the room before the cryptocurrency moves, not after.
The numbers, read slowly
Sophos surveyed 3,400 IT and cybersecurity leaders at organisations hit by ransomware, across 17 countries, for its State of Ransomware 2025 report. Nearly half of the organisations that had data encrypted paid to get it back. The median payment was about one million dollars, although 53 percent of those who paid negotiated a figure below the original demand, most of them with help from negotiators or incident responders.
Read the next figure alongside it. The average cost of recovering from an attack, excluding any ransom, fell to 1.53 million dollars, down from 2.73 million a year earlier. In other words, the recovery bill — forensics, rebuilding, downtime, legal work, lost business — is typically larger than the median ransom itself, and it arrives whether the ransom is paid or not. A payment is not a shortcut around that bill. It is an addition to it.
Recovery itself usually happens without the attackers' help. In the same survey, 97 percent of organisations whose data was encrypted got data back by some route. Backups were used in 54 percent of recoveries, the lowest share in six years, a figure that should worry anyone treating backup as a solved problem. Attackers know backups are the exit door, and modern intrusions hunt for backup servers and snapshots early, precisely so the victim feels payment is the only door left. That is why the layered approach set out in our guide to ransomware defence built on immutable storage and air-gapped copies treats an untested backup as no backup at all.
The refusal trend shows up in a second, independent place. Verizon's 2025 Data Breach Investigations Report found ransomware present in 44 percent of breaches, up from 32 percent the year before, and found that 64 percent of ransomware victims in its dataset did not pay. Chainalysis, tracking the money itself on public blockchains, estimated ransomware payments of about 813.55 million dollars in 2024, down roughly 35 percent from the record 1.25 billion dollars of 2023, and attributed the fall partly to victims refusing more often. Three different lenses — surveys, breach investigations, blockchain flows — point the same way.
Why paying keeps disappointing people
Some of the disappointment is mechanical. A decryptor supplied by a criminal group is software written in a hurry by people with no support desk. Decryption can be slow, partial or corrupting, and large databases are the files most likely to come back damaged. A business can pay in full and still face the rebuild it was trying to avoid.
Some of it is structural. Paying marks a victim as a payer. Incident responders have documented repeat attacks against organisations that settled quickly, sometimes by the same affiliate network that sold or shared access the first time. The ransom note is a contract with a counterparty whose entire business model is breaking agreements at scale.
And some of it is the leak that payment was supposed to prevent. Stolen data is copied, not moved. Once it sits on an attacker's server, a promise to delete it is unverifiable by design. Victims who paid to suppress a leak have watched the same files surface later, in fragments, in other hands. This is the quiet reason the guidance from security teams has hardened: you can sometimes rent back your own uptime, but you cannot purchase back your confidentiality.
Detection speed changes this picture more than negotiation skill does. The earlier an intrusion is caught, the less there is to encrypt or steal, which is the case for the monitoring approaches described in our piece on AI-assisted detection cutting the time to spot an attack. By the time the ransom note appears, most of the financial outcome has already been decided by decisions taken months earlier.
It is easy to write never pay. It is harder to say it in a hospital corridor, or in a factory where every hour of downtime burns more than the demand, or at a small firm whose backups turned out to be encrypted along with everything else. These are the cases where boards consider payment, usually through professional negotiators, after legal advice, and often with an insurer involved. The data does not make those decisions immoral or irrational. It makes them gambles taken under duress, with odds the decision-makers should see clearly before they wire anything.
Even in those cases, the preparation work decides most of the outcome. An organisation that has rehearsed its response, isolated its backups, segmented its network and kept an incident retainer on call negotiates from a position. One that is improvising its first crisis meeting while systems burn negotiates from panic, and attackers can tell the difference within a single exchange. The long-game threat described in our reporting on nation-state espionage that harvests data now to decrypt later underlines the same point from the other end: data taken today keeps its value for years, so the theft half of the extortion cannot be undone by any payment.
Insurers, for their part, have tightened what they will fund. Policies increasingly require evidence of specific controls — multi-factor authentication, endpoint detection, tested and isolated backups — before they will consider covering a payment or the recovery around it. The market is, in effect, pricing the answer to this article's question: organisations with working defences pay ransoms rarely, because they rarely need to.
Negotiation is not a strategy either. That 53 percent figure draws boardrooms in: most payers settled below the original demand. It is tempting to read that as proof that a good negotiator turns a bad day into a manageable one. Read it more carefully. A discounted ransom is still a ransom, paid to the same counterparty, for the same uncertain decryptor, while the recovery bill runs in parallel. The discount changes the size of one line in the final account. It does not change which lines exist.
Negotiators earn their fee in a different way, and it is worth understanding. They slow the clock. Attackers set deadlines to force panic, and a professional intermediary stretches the conversation, tests whether the criminals actually hold the data they claim to hold, and buys the victim time to restore, rebuild and take legal advice in parallel. In the best-run incidents, the negotiation is not really about paying less. It is about discovering, during the delay, that payment is not needed at all because the backups held or the intrusion was contained earlier than feared. Time, not haggling, is the product.
That distinction matters for smaller firms without a retainer in place. The first call after discovery should not be to the attacker's chat window. It should be to the insurer, to counsel, and to an incident response firm, in whatever order the cyber policy dictates — because contacting the criminals directly, or restoring systems before forensic images are taken, can void coverage and destroy evidence investigators later need. Panic is expensive in specific, avoidable ways.
A decision to make before the day comes
The worst version of this choice is the one made at 3 a.m. by exhausted people who have never discussed it before. Companies that handle ransomware best tend to have decided their position in advance, in writing, with the board, their lawyers and their insurer in the same conversation. That policy can leave a narrow, documented exception for an existential case. What it cannot be is improvised.
The practical checklist is short, and none of it is exotic. Keep backups that are immutable or physically separated, and restore from them in drills, not just in theory. Patch the exposed edge devices attackers use to get in, since exploited vulnerabilities remain the most common technical root cause in the Sophos data. Watch for the early signs of intrusion rather than the final note, and layer defences so a single failure is not the whole story, in the spirit of runtime protection that assumes the perimeter will fail. And report incidents to authorities promptly, whichever way the payment decision goes — the report costs nothing and occasionally returns a decryption key from a seized server.
So, should a business ever pay? The evidence supports a narrow answer. Plan not to. Build so that you do not have to. Treat any exception as a legal and financial decision taken with open eyes, in the knowledge that payment buys a possibility, not an ending. The organisations refusing in growing numbers are not being reckless with their survival. They have simply read the same figures, and noticed that the ransom was never the expensive part.
