Should you pay the ransom? What to weigh before deciding

Fewer victims are paying, and the demands are falling with them

The first useful thing to know is that you would not be an outlier. Verizon’s 2026 Data Breach Investigations Report found that 69% of ransomware victims did not pay, up from 64% the year before, with a median amount paid of USD 139,875. Sophos, surveying 2,158 IT and cybersecurity leaders across 17 countries whose organisations were hit in the previous year, saw the same direction of travel: 48% of the organisations whose data was encrypted paid — the lowest rate in three years — while 66% recovered from backups.

The two reports measure different populations — the DBIR draws on incident data, Sophos surveys victims — so their median-paid figures are not comparable and should not be blended. What they agree on is the trend, and the demands are moving with it. In the Sophos data the median ransom demand fell to USD 698,000, continuing a multi-year decline from USD 1.3 million in the 2025 report and USD 2 million in the 2024 report; across those two years median demands are down 65% and payments down 62%. The median payment is now USD 769,000, from USD 1 million last year, and 48% of payments were USD 1 million or more, down from 52%.

What payment buys, and what it does not

The negotiation, in numbers

Almost nobody writes down what actually happens between the demand and the transfer, so here it is. Of the 507 organisations that shared both their demand and their payment, the median settled at 90% of the initial ask: 51% paid less than the demand, 30% paid exactly what was demanded, and 18% paid more.

Leverage is unevenly distributed. The largest enterprises — USD 5 billion or more in revenue — negotiated best, with 57% paying below the demand and only 11% paying above it. Mid-sized organisations in the USD 50–250 million band did worst, with 25% paying more than the demand. The demand itself scales with what the attacker thinks a foothold is worth: 59% of demands from attacks that started with an exploited vulnerability on the firewall were for USD 1 million or more, against 48% of demands overall.

What none of that measures is where the leverage comes from. A negotiator argues from a position, and the position is whether you can walk away — decided by the state of your backups long before the demand arrives.

Check whether you need to pay at all

Before any commercial discussion, CISA’s #StopRansomware Guide — written with MS-ISAC, the NSA and the FBI — tells you to "consult federal law enforcement, even if mitigation actions are possible, regarding possible decryptors available, as security researchers may have discovered encryption flaws for some ransomware variants and released decryption or other types of tools". Free decryptors exist for a number of families. Checking costs a phone call.

The legal exposure, stated precisely

The clearest published position belongs to the US Treasury’s Office of Foreign Assets Control, in its Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments of 21 September 2021, which superseded its 1 October 2020 advisory. OFAC states that "the U.S. government strongly discourages all private companies and citizens from paying ransom or extortion demands and recommends focusing on strengthening defensive and resilience measures".

Three details matter operationally. First, the advisory reaches beyond the victim: companies that facilitate payments on a victim’s behalf, "including financial institutions, cyber insurance firms, and companies involved in digital forensics and incident response", may risk violating OFAC regulations. Second, "OFAC may impose civil penalties for sanctions violations based on strict liability" — not knowing who received the money is not a defence, and you rarely know at the time of payment. Third, OFAC names its mitigating factors: meaningful steps taken in advance to reduce extortion risk, including practices from CISA’s guidance, are "a significant mitigating factor", and a self-initiated, complete and timely report to law enforcement, with full cooperation during and after the attack, is treated as a voluntary self-disclosure and a significant mitigating factor in its own right.

Paying does not close the incident

A decryption key restores files. It does not remove the access that produced them. CISA warns that "a ransomware event may be evidence of a previous, unresolved network compromise" and names Bumblebee, Dridex, Emotet, QakBot and Anchor as precursor malware to look for. It is blunter still about the sequence: "Malicious actors often drop ransomware variants to obscure post-compromise activity. Care must be taken to identify such dropper malware before rebuilding from backups to prevent continuing compromises."

So the work after a payment is the same work as after a refusal: find the entry point, hunt for the dropper, rebuild on a clean network, and meet your reporting obligations. Payment buys you back one input to that process, at a price, from a counterparty with no obligation to deliver. The full sequence is set out in building a ransomware recovery plan that works under pressure.

The cost you are actually comparing against

The alternative is not "unlimited downtime". In the Sophos data the average recovery cost excluding any ransom is USD 1.7 million, up 11% on the year; 55% of organisations were fully recovered within a week, 16% within a day and 83% within a month, with only 3% taking longer than three months. Recovery is expensive and slow. It is also finite, priced in advance, and does not require a criminal counterparty to keep a promise.

Preparation is what makes "no" available

Notice what the numbers keep pointing at. Backup-based recovery surged to 66% of the attacks where data was encrypted, up from 54% — a rebound Sophos reads as renewed investment in backup infrastructure — while the share of victims paying fell to its lowest in three years. The two move together. The organisations that could say no had done the work beforehand.

• Keep offline or immutable backups and test the restore, against a stated recovery time.
• Rehearse the incident plan so the decision is made by prepared people, not panicking ones.
• Reduce the odds of a successful attack in the first place — malicious email and phishing are now half of all ransomware root causes.
• Report early: OFAC treats a self-initiated, timely and complete report to law enforcement as a significant mitigating factor, and it costs nothing to make.

Get those right and the question largely answers itself. What builds them is set out in the ransomware readiness checklist.