iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Usually, no. The FBI, CISA, and the UK National Cyber Security Centre (NCSC) discourage paying a ransomware demand. Payment may not restore your files, stop stolen data from being exposed, or remove the attacker from your systems. If you are dealing with an active incident, contain it, assess clean recovery options, and get qualified technical and legal advice before making a decision. Whether a payment is lawful depends on the jurisdictions and parties involved.
What does paying a ransomware demand actually do?
It transfers money to the attacker in exchange for a promise—often a decryption key, the return of stolen data, or both. That promise is not a guarantee. The FBI says it does not support paying a ransom; CISA, the FBI, and Australia’s ASD’s ACSC say payment does not guarantee that victims will recover their files.
It may not restore your files
An attacker may fail to provide a working decryptor, or the tool may only partly restore data. Even when decryption works, restoring large systems can take time. A key also does not establish that every file is intact or that the restored environment is safe to use.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
It may not prevent a data leak
In a double-extortion attack, criminals steal information as well as encrypt systems, then threaten to publish or sell the stolen data. The UK NCSC warns that victims cannot trust an attacker’s promise to delete the data after payment. A payment therefore cannot be treated as proof that a leak has been prevented.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
It does not clean or secure the network
Paying does not remove malware, close the route the attacker used to get in, or prove that the attacker has lost access. Those tasks require investigation and a clean recovery process, whether or not a payment is made.
Is paying illegal?
There is no single answer that applies to every country, victim, payment recipient, and incident. The legal position depends on the jurisdictions involved and the facts, so an organization should consult qualified counsel before transferring funds.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
UK sanctions can prohibit a payment
The UK NCSC says paying may be unlawful when the recipient is an entity or area subject to UK sanctions. UK financial sanctions guidance, updated 28 January 2026, says sanctions prohibit making funds or economic resources available to a designated person or entity, including through a ransom payment. It also says payment facilitators should assess their exposure and conduct due diligence. Sanctions lists and rules can change; check the current position with appropriate legal and sanctions advisers rather than relying on an attacker’s identity claims.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Payment does not settle regulatory duties
For UK organizations, the NCSC says paying a ransom does not satisfy regulatory obligations and is not considered by the Information Commissioner’s Office (ICO) to be a risk mitigation. This is UK-specific guidance; it should not be generalized to every regulator or jurisdiction. Determine separately whether the incident triggers duties to notify a regulator, affected people, customers, contractual partners, or authorities.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
How should you decide what to do?
There is no reliable formula that turns these factors into a universal yes-or-no answer. Compare the practical recovery options and consequences, and record the evidence behind the decision.
| Factor | Questions to assess |
|---|---|
| Recovery options | Are backups usable, clean, and available? Are there other ways to restore the affected systems? Is a known decryptor available for this specific ransomware variant? |
| Time and operational impact | How long might restoration take? How long can workarounds continue, and what happens if essential operations remain unavailable? |
| Safety and affected people | Could disruption put people at risk, interrupt essential services, or disproportionately affect vulnerable people? |
| Data exposure | What information may have been accessed or stolen, and how sensitive is it? Treat attackers’ claims about the amount stolen as unverified until investigated. |
| Legal and contractual duties | Which jurisdictions, sanctions rules, notification requirements, and contractual obligations apply to the victim, recipient, and any payment facilitator? |
| Cost and continuing risk | What are the likely costs of restoration and disruption? Is the attacker still present, or is there a risk of repeat access or further extortion? |
These are decision factors, not reasons to assume that paying will solve the problem. Consider the consequences of a payment alongside the time, feasibility, and risks of recovery without one.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
What to do before deciding
- Contain the incident. Follow your incident response plan and work with responders to isolate affected systems as appropriate. Preserve relevant logs, system images, memory, ransom notes, and communications when feasible; containment should not mean destroying evidence.
- Check recovery options. Assess backups and other restoration paths. Before reconnecting restored systems, verify that both the backups and the target environment are clean. Ask incident responders or authorities whether a known decryptor exists for the specific variant.
- Establish what happened. Investigate how the attacker gained access, whether the attacker may still have access, and what information may have been taken. Do not treat a ransom note as reliable evidence of the scope of the incident or of data deletion.
- Bring in the right advisers. Involve qualified incident response experts, relevant organizational leaders, insurers, and legal counsel as applicable. Keep a contemporaneous record of what was known, the advice received, and the reasons for decisions.
- Check legal and reporting requirements. Identify the jurisdictions and rules that apply, including sanctions, contracts, and regulator or individual notification duties. Contact relevant authorities; U.S. victims can use the reporting channels identified by the FBI and CISA.
- If payment is still under consideration, get specialist advice first. Seek advice on whether and how to communicate with the attacker, independently verify claims about the intrusion, and determine whether a payment would be lawful. Do not assume payment will restore systems or prevent disclosure.
Should you report ransomware if you pay—or are considering it?
Yes. The FBI urges victims to report ransomware incidents regardless of whether they pay. Reporting can help authorities understand the incident and may provide access to guidance relevant to the case. For U.S. incidents, consult the FBI and CISA’s current reporting information; reporting routes and obligations differ by jurisdiction.
What if a payment has already been made?
Continue treating the incident as active until qualified responders have assessed it. Preserve payment records and communications, report the incident through relevant channels, and follow legal advice about any applicable sanctions or notification obligations. Continue investigating the intrusion, validating backups, and rebuilding or restoring systems safely; payment is not evidence that access has ended or data has been deleted.
How can organizations reduce the pressure to pay?
Preparation cannot guarantee that an organization will avoid an attack, but it can give decision-makers more options during one. Maintain backups separated from networked systems, and make sure restoration is tested rather than assumed. Keep an incident response plan, know who can authorize urgent decisions, and establish how technical, legal, operational, and communications teams will work together. Backup separation and tested recovery matter more than buying a particular storage device.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
