iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Usually, no. Paying a data-extortion ransom is not a dependable way to decrypt systems, restore operations, stop publication, or make criminals delete stolen information. US agencies discourage payment, and UK guidance does not condone it. Treat the demand as one input to a documented incident decision—not as a guaranteed recovery service. First contain the incident, preserve evidence, test recovery options, obtain incident-response and legal advice, check sanctions, and meet reporting and notification duties. The correct decision depends on the facts, jurisdiction, safety impact, and available alternatives.
What “data extortion” means
Data extortion is a threat to publish, sell, or otherwise misuse information stolen from an organization. Criminals can make that threat even when no files were encrypted. In a “double-extortion” attack, the intruder both exfiltrates data and encrypts systems, demanding money for a decryption key and for not releasing the stolen data. The CISA-led #StopRansomware Guide describes exfiltration and threats to release data as possible parts of ransomware incidents, including cases where encryption is absent.
The distinction changes the decision. A decryption key could, in theory, help with encrypted files, but it cannot put copied data back under your control. If an attacker has already downloaded records, payment cannot technically recall every copy, prevent private sharing, or prove deletion.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Why payment is not a reliable fix
Official guidance consistently treats a ransom promise as unverified. The FBI states: “Paying a ransom doesn’t guarantee you or your organization will get any data back.” The statement appears in the FBI’s Ransomware guidance and applies to recovery expectations, not just to one type of victim.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
- Decryption may fail. A criminal may send no key, an incomplete key, or faulty software. The UK National Cyber Security Centre (NCSC) warns that even a usable decryptor may not quickly return systems to normal.
- Operations may remain disrupted. Rebuilding, validating backups, removing persistence, and checking for additional compromise still take time after a payment.
- Deletion cannot be verified. An attacker can retain, copy, sell, or privately distribute exfiltrated data after claiming it was destroyed.
- Silence is not enforceable. Criminal groups can publish a sample to pressure you, demand a second payment, or pass the material to another group.
- Repeat targeting is possible. Payment can identify an organization as willing or able to pay and does not close the vulnerability that enabled the intrusion.
- Payment can complicate legal exposure. A transaction involving a sanctioned person, wallet, facilitator, or jurisdiction can create sanctions risk, even when the payer did not intend to violate a restriction.
The UK Information Commissioner’s Office (ICO) states: “The ICO does not consider the payment of a ransom as an ‘appropriate measure’ to restore personal data.” That is UK regulator guidance, not a universal rule for every country, but it captures the practical limitation: payment does not restore control over copied personal data.
A decision framework for an incident team
Do not make a universal yes-or-no rule before an incident. Establish a decision group that includes executive leadership, the incident-response lead, qualified counsel, security and IT, the insurer if applicable, communications, and relevant safety or clinical leaders. Ask each participant to state assumptions and confidence levels, and keep a dated record of the evidence and advice.
| Decision axis | Questions to answer | Evidence to collect |
|---|---|---|
| Recovery | Can critical services be restored from clean, tested backups? Can a clean rebuild, partial recovery, a workaround, or a legitimate decryptor meet the required timeline? | Backup dates and isolation, restoration tests, dependency maps, recovery-time estimates, known decryptors from responders or law enforcement. |
| Data exposure | What was accessed or exfiltrated? How sensitive is it, whose rights could be affected, and does the attacker’s sample actually match your systems? | Logs, endpoint and identity telemetry, data classifications, access scope, forensic findings, and independently validated samples. |
| Operational and human impact | Could delay affect patient care, physical safety, essential services, vulnerable people, or a workaround’s sustainability? | Safety assessments, service-level obligations, staffing capacity, manual-process limits, and maximum tolerable downtime. |
| Legal and regulatory exposure | Are sanctions implicated? Which privacy, sector, contractual, preservation, or reporting duties apply? | Counsel’s jurisdiction-specific analysis, current sanctions checks, contracts, regulator rules, and incident timelines. |
| Total cost and future risk | What are the response, restoration, legal, notification, business-interruption, and monitoring costs? What is the risk of another extortion attempt? | Scenario estimates, insurer terms, remediation plans, and threat-intelligence information. |
| Evidence and cooperation | Can the organization preserve artifacts and provide useful information promptly to authorities and responders? | Imaging plan, chain-of-custody records, ransom notes, wallet instructions, malware, logs, and communications. |
Use the table to compare courses of action rather than to justify a predetermined payment. The NCSC’s Guidance for organisations considering payment in ransomware incidents recommends objective external expertise and careful records of decisions, actions, captured or missing data, and supporting evidence.
What to do before discussing a transfer
- Activate the incident plan. Assign an incident commander, establish a secure communications channel, and involve leadership, counsel, responders, the insurer, and government contacts as appropriate.
- Contain without destroying evidence. Isolate affected devices or segments when safe, preserve volatile and persistent artifacts, and avoid wiping systems before responders advise on imaging.
- Confirm the scope. Determine which accounts, endpoints, servers, cloud resources, and repositories were accessed. Investigate whether data was exfiltrated; do not accept the criminal’s description as proof.
- Protect backups. Disconnect or otherwise isolate backup systems that could still be reached. Identify the last known clean copy, verify its integrity, and test restoration in a controlled environment.
- Ask about lawful recovery tools. Incident responders and law enforcement may know of a legitimate decryptor, a recovered key, or a campaign-specific weakness. Do not download unverified tools from an extortion site.
- Build safe workarounds. Consider manual processing, alternate systems, or partial restoration for essential services while the environment is investigated and rebuilt. Document safety and privacy effects.
- Find and close the entry route. Reset compromised credentials, remove persistence, patch exploited weaknesses, disable exposed services, and verify identity and remote-access controls before reconnecting restored systems.
- Map obligations. Have counsel assess privacy, sector, contractual, insurance, sanctions, preservation, and customer-communication requirements. Payment does not cancel any of them.
- Report promptly. The FBI accepts reports through a local field office or IC3, and CISA’s guide identifies its reporting channels. Confirm current contact details on the agencies’ live pages.
- Record the decision trail. Preserve the demand, negotiation messages, wallet addresses, malware, logs, forensic conclusions, options considered, advice received, approvals, and the reason for every action.
Alternatives to paying
Restore from isolated, tested backups
A recoverable backup program uses appropriately isolated and redundant copies, regular restoration tests, and documented recovery priorities. A single consumer external drive can be useful for an offline copy, but possessing a drive alone does not make an organization recoverable; it may be encrypted, connected during the attack, incomplete, or too slow for the required scale. Validate that backups include configurations, identity dependencies, keys, and the data needed to operate—not just user files.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Rebuild cleanly
When compromise is broad, a clean rebuild can be safer than trying to disinfect every system. Preserve evidence first, establish trusted administrative credentials, patch and harden the environment, restore in phases, and monitor for renewed access. A ransom or decryptor does not remove the attacker’s foothold.
Use partial recovery and workarounds
Prioritize systems that protect life, safety, payroll, legal deadlines, or essential customer functions. A temporary manual process or isolated replacement service may reduce harm while forensic work continues. Set an owner, an expiry date, and controls for access, data quality, and fraud risk for each workaround.
Seek government and specialist assistance
Law enforcement and experienced incident responders can help identify campaigns, preserve evidence, locate decryption resources, validate claims, and coordinate reporting. A commercial responder does not replace legal advice, regulators, or law enforcement; use counsel to manage privilege and conflicts.
Recommended Free Tools
Sanctions and payment law
United States: sanctions are fact-specific
The US Treasury’s Office of Foreign Assets Control (OFAC) says making or facilitating a ransomware payment may create sanctions risk when the actor, wallet, intermediary, or transaction has a sanctions nexus. Its Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments strongly discourages payment and recommends defensive and resilience measures. The advisory is explanatory and does not itself have the force of law; do not assume every US ransom payment is automatically illegal. Counsel should identify the parties and transaction path, check current sanctions information, and assess whether a license, reporting, or mitigation issue exists.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
United Kingdom: check current designations
UK Office of Financial Sanctions Implementation (OFSI) guidance says financial sanctions prohibit making funds or economic resources available directly or indirectly to a designated person, including through a ransomware payment. It describes possible civil and criminal consequences and recommends due diligence, reporting, and legal advice. The guidance was updated 28 January 2026, but designations can change; perform a current-list check immediately before any proposed transfer. Read the OFSI financial sanctions guidance for ransomware with UK counsel.
Other jurisdictions
Countries differ on sanctions, payment restrictions, mandatory reporting, insurance conditions, and criminal or civil consequences. A multinational organization may have obligations in several places at once. Identify where the payer, bank, insurer, attacker, affected people, and data are located, then obtain advice for each relevant jurisdiction.
Privacy, breach notification, and sector duties
UK personal-data breaches
The ICO treats a ransomware incident involving personal data as a potential personal-data breach. If the breach is likely to risk individuals’ rights and freedoms, notify the ICO without undue delay and no later than 72 hours after becoming aware. If that risk is unlikely, notification may not be required, but record the breach and the assessment. Exfiltration is relevant to the risk analysis. The ICO’s Ransomware and data protection compliance guidance also makes clear that payment does not restore control or remove the duty to mitigate harm.
United States notifications
US duties depend on applicable state breach laws, federal sector rules, contracts, and the facts. There is no single deadline that applies to every US victim. CISA’s guide directs organizations to the relevant state notification requirements and federal rules for certain data. Counsel should map the affected data and people to each applicable law, including requirements for regulators, customers, employees, and business partners.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
CIRCIA reporting caveat
The 2024 US Code text of 6 U.S.C. § 681b provides a 72-hour deadline for a covered entity to report a covered cyber incident after reasonably believing it occurred and a 24-hour deadline for a covered entity to report a ransomware payment. Those provisions apply only to entities and incidents meeting statutory definitions. Confirm current CISA implementing rules, effective requirements, and coverage before treating either deadline as an operational duty for your organization.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If leadership still considers payment
Payment should be an exceptional, documented choice made only after alternatives, safety consequences, legal exposure, and recovery timelines are understood. Never let an attacker’s countdown replace governance. Use qualified responders and counsel to communicate, preserve evidence, verify the recipient and transaction path, and coordinate with law enforcement and the insurer. Confirm sanctions status at the time of transfer, establish who can authorize funds, and require written approval that records the expected benefit and the possibility of failure.
Even after a decision to pay, continue containment, forensic investigation, rebuilding, notification analysis, and monitoring. Treat every exfiltrated record as potentially compromised. Do not promise customers, employees, regulators, or a board that data was deleted unless you have evidence that meets the applicable standard—and in most extortion cases, you cannot independently prove it.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsCommon mistakes that make an incident worse
- Paying before checking whether clean backups or a known decryptor can meet the business need.
- Assuming an attacker’s file list proves the full scope of access, or assuming the absence of a sample proves no exfiltration.
- Restoring systems before removing the original access route.
- Allowing an insurer, negotiator, or cryptocurrency service to transfer funds without sanctions and legal review.
- Wiping infected devices, deleting logs, or moving communications to personal accounts before evidence is preserved.
- Treating payment as a substitute for breach assessment, regulator notification, customer communications, or remediation.
- Using one connected external drive as the entire backup strategy.
- Failing to document who decided, what evidence was available, which alternatives were tested, and why the selected action was proportionate.
A practical leadership checklist
- Incident commander and decision authority named.
- Qualified incident-response firm and counsel engaged.
- Insurer and relevant government contacts notified as appropriate.
- Affected systems contained and evidence preserved.
- Exfiltration scope and attacker claims independently assessed.
- Clean backup, rebuild, workaround, and decryptor options tested or estimated.
- Safety, patient, customer, employee, and vulnerable-person impacts assessed.
- Current sanctions lists and transaction path reviewed.
- Privacy, sector, contractual, preservation, and reporting duties mapped.
- All actions, advice, approvals, and uncertainties recorded with dates.
The practical conclusion is not that every organization faces the same answer. It is that payment should never be treated as guaranteed recovery or guaranteed secrecy. A disciplined response maximizes the chances of restoring essential services, limits harm to affected people, preserves legal options, and leaves a defensible record whether money changes hands or not.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
