Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Usually, no. The FBI says it does not support paying a ransom. Payment may produce no usable decryption key, does not guarantee that stolen data will stay private, and can encourage further attacks. Treat a ransomware event as an incident-response and recovery problem: contain affected systems, preserve evidence, involve qualified responders and legal advisers, check clean backups and variant-specific decryptors, and rebuild from known-good systems where possible.
This is a U.S.-weighted guide. Reporting channels, sanctions rules, insurance terms and payment restrictions differ by jurisdiction, so an organization should obtain advice specific to its location and circumstances before making any transaction.
The direct answer: do not assume payment is the safest way out
The FBI’s published position is unambiguous: “The FBI does not support paying a ransom in response to a ransomware attack.” Its guidance also says, “Paying a ransom doesn’t guarantee you or your organization will get any data back.” A criminal may send a broken, incomplete or unusable key, disappear after receiving money, or demand more money later. If files were copied before encryption, payment for a decryptor does not ensure that the copied information will not be published or sold.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePayment can also make the victim a more attractive target and finance additional attacks. The FBI asks victims to report the incident whether or not they pay. The practical question is therefore not simply “Can we buy a key?” It is whether the organization can contain the compromise, protect people and operations, recover trustworthy systems, satisfy legal duties and manage any data theft.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
There is no official, representative statistic establishing the probability that a victim will recover data after paying. Any decision based on a claimed success rate from an attacker, broker or anecdotal case is speculation, not a guarantee.
Read the FBI’s current victim guidance at fbi.gov/how-we-can-help-you/common-frauds-and-scams/ransomware.
Why a ransom payment can fail
A key may not restore the files
Ransomware operators are not a dependable recovery service. Even when they provide software or a key, it may fail on some files, damage file structures, require a long manual process or be incompatible with the exact variant. A payment also cannot repair systems, remove persistence, restore deleted backups or prove that the attacker has lost access.
Payment does not undo data theft
Encryption and exfiltration are separate risks. Attackers may claim to have copied files, and an organization must investigate that claim independently. A decryption transaction addresses, at most, the demand for a key. It cannot force a criminal to delete copies or prevent disclosure. Treat potentially stolen information as a separate incident involving privacy, contractual, regulatory and notification questions.
It can finance the next victim
The FBI warns that paying can encourage perpetrators to target more victims and incentivize others to join the crime. The payment may therefore reduce an immediate pressure while increasing the wider threat. That public-interest concern is one reason federal guidance discourages payment even when downtime is severe.
It can create legal and sanctions exposure
For a U.S.-connected incident, a payment or assistance with a payment can create sanctions risk if the recipient, wallet, facilitator or transaction has a sanctions nexus. The Office of Foreign Assets Control (OFAC) updated its ransomware advisory on September 21, 2021. It says license applications for ransomware payments are reviewed case by case with a presumption of denial, and that companies facilitating a payment may also face risk. The advisory is explanatory; it does not itself change the law or cover every legal obligation. Do not conclude that every ransom payment is automatically illegal, but do not transfer funds without current sanctions and legal advice.
Four factors that should drive an incident-specific decision
No checklist can turn payment into a reliable recovery method. Incident leaders, qualified responders, counsel and relevant authorities should assess the following factors together:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
| Factor | Questions to answer | Why it changes the response |
|---|---|---|
| Clean, tested backups | Are backups offline or otherwise isolated, encrypted, available and known to be clean? When was restoration last tested? | A verified recovery path can remove the need to obtain a criminal’s key. An untested or connected backup may be incomplete or compromised. |
| Operational and public-safety impact | Which services are down? Does downtime affect patient care, emergency functions, physical safety, contractual deadlines or essential revenue? | Impact determines containment priorities, temporary workarounds, communications and the level of specialist support required. It does not make a key guaranteed. |
| Possible data exfiltration | Do logs, attacker statements or responder findings indicate that information was copied? What kinds of records could be involved? | Encryption recovery and privacy response are different workstreams. Payment does not ensure confidentiality. |
| Legal, sanctions, insurance and contracts | What reporting, notification, records-retention, insurance and supplier obligations apply? Could a wallet or facilitator be sanctioned? | Counsel can identify restrictions and preserve coverage. Insurance approval is not permission to ignore sanctions or law-enforcement requests. |
Use these factors to prioritize actions, not to calculate a supposed “safe” ransom amount. The FBI and CISA guidance supports containment, evidence preservation, reporting and recovery regardless of whether a payment is ultimately considered.
What to do in the first hours
Move deliberately. Rushed cleanup can destroy evidence, spread the malware or overwrite the information responders need.
- Activate the incident-response plan. Name an incident lead, establish a secure communications method and record decisions and times. If there is no plan, call a qualified incident-response provider and the organization’s legal and insurance contacts.
- Isolate affected systems. Disconnect compromised computers, servers, virtual machines and network segments from wired and wireless networks where feasible. Disable suspected remote access paths according to responder advice. Do not reconnect devices merely to see whether they work.
- Protect evidence. Preserve the ransom note, encrypted-file extensions, attacker email addresses or websites, wallet address, demand, chat history, affected host names and a timeline. Preserve volatile evidence and logs before wiping or rebuilding when responders advise it. Keep original files and media available for forensic work.
- Protect unaffected systems and backups. Restrict administrative access, separate backup infrastructure and monitor for additional affected hosts. Do not attach an offline backup to a compromised network until responders have assessed the environment.
- Call the appropriate authorities. U.S. victims can contact an FBI field office or submit a report to the Internet Crime Complaint Center (IC3). CISA can provide guidance and coordination for applicable organizations. Reporting is appropriate even if the organization pays.
- Bring in legal and privacy advisers. Counsel can coordinate sanctions screening, contractual notices, regulator or customer communications, preservation obligations and any ransom-related decision. Do not send sensitive incident details through an attacker-controlled channel.
Capture the details that make help possible
Responders and investigators need facts that are easy to lose during a crisis. Create a read-only incident record containing:
- The ransom note in its original form, including file names, dates and contact instructions.
- One or more encrypted-file extensions and representative file paths; do not alter the originals.
- Attacker email addresses, websites, chat handles, telephone numbers and cryptocurrency wallet addresses.
- The demanded amount, currency, deadline, any claimed discount and every subsequent demand.
- Systems and accounts known or suspected to be affected, including cloud and remote-access services.
- When unusual activity, encryption, shutdowns or ransom messages were first observed.
- Evidence suggesting data was copied, such as archive files, unusual outbound transfers or an attacker’s file list.
- Whether any payment was made, by whom, when and through which facilitator.
IC3 specifically requests information such as the known variant, encrypted-file extension, cryptocurrency and address, attacker contact details, demand and payment status. Submit only through the official channel: ic3.gov/CrimeInfo/Ransomware.
Recommended Free Tools
Check whether a decryptor exists for the exact variant
A decryptor is a possible recovery aid, not a reason to delay containment. CISA advises consulting federal law enforcement about available decryptors because researchers sometimes find flaws and release tools. Availability is variant-specific: a tool for one family, version or configuration may not work for another.
- Give responders the ransom note, sample encrypted files and extension, but retain untouched originals.
- Have investigators identify the likely ransomware family and confirm the identification with more than the attacker’s label.
- Ask law enforcement or a qualified responder whether a trusted decryptor exists for that exact variant.
- Test any tool on copies in an isolated environment. Do not download an alleged decryptor from an unknown website or run it on production systems.
- Document the result, including files that remain damaged or inaccessible. A successful decryption test does not prove that the attacker’s access has ended.
Recover without paying
Use known-clean, offline backups
CISA’s joint ransomware guide recommends offline, encrypted backups and restoration tests performed in a disaster-recovery scenario. Inventory the available backup sets, their dates and their owners. Before restoring, have responders scan the media when possible and verify that the backup predates the compromise or is otherwise known to be clean.
One offline external hard drive can be part of a preparedness plan, but it is not a decryptor and cannot fix an active compromise. Keep backup media disconnected except during controlled backup or restoration work, and follow responder instructions before reconnecting it.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Rebuild from a known-good image
Do not treat successful file decryption as proof that a system is safe. Rebuild critical hosts from known-good golden images or installation media, patch and harden them, rotate exposed credentials, remove unauthorized accounts and access paths, and verify monitoring before placing them back into service. Restore data only after the rebuilt environment is ready.
Restore in an order that protects essential operations
Work with business and public-safety owners to rank systems. Restore identity, network, communications and other dependencies in a controlled sequence, then application data. Keep restored systems segmented and monitor them for renewed malicious activity. Record which data was restored, from which backup and on what date so that gaps can be investigated.
Handle stolen data as its own workstream
Forensic responders should determine what may have left the environment, when it left and whose information it contains. Notify affected parties only after counsel and the responsible authorities have established what the law and contracts require. A restoration plan cannot substitute for this assessment.
Reporting and legal considerations for U.S. victims
Report the incident even if no ransom is paid, and report it even if payment is made. The FBI’s ransomware page explains reporting options at fbi.gov/how-we-can-help-you/common-frauds-and-scams/ransomware. IC3 accepts online complaints at ic3.gov/CrimeInfo/Ransomware. CISA’s operational guide is available at cisa.gov/stopransomware/ransomware-guide.
OFAC’s updated advisory, dated September 21, 2021, warns that a payment involving a sanctioned person, group, wallet or jurisdiction may violate U.S. sanctions rules. It also says that substantial cooperation with law enforcement before a transaction can be a mitigating factor in enforcement, while it does not guarantee a particular outcome. Because sanctions designations and legal requirements change, counsel should check the current position at the time of the incident. The advisory is at ofac.treasury.gov/media/912981/download?inline=.
Other countries may impose different restrictions, reporting deadlines or notification duties. A U.S. organization with overseas staff, customers, suppliers or infrastructure may have several legal regimes to consider.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If leadership is still considering payment
Payment is not recommended by the FBI, but an organization that is evaluating every option should impose a formal approval process rather than negotiating informally under pressure.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
- Obtain written advice from sanctions counsel and incident-response specialists before any transaction.
- Ask law enforcement whether the recipient, wallet, facilitator or known infrastructure creates a sanctions concern.
- Confirm what the organization’s insurer and contracts require, without treating approval as a legal safe harbor.
- Preserve the original demand and all communications; do not conceal or alter evidence.
- Separate any proposed decryption transaction from decisions about disclosure, notification and system restoration.
- Plan for failure: assume the key may not work, the attacker may demand more, and copied data may still be released.
- Report the incident and record the decision, the people who approved it and the advice they received.
These controls reduce avoidable harm; they do not make payment reliable or remove the need to rebuild and investigate.
What the historical statistics do—and do not—show
OFAC’s 2020 advisory cited FBI Internet Crime Reports showing a 37 percent annual increase in reported ransomware cases from 2018 to 2019 and a 147 percent increase in associated losses over the same period. Those are historical reported figures, not a current prevalence estimate, a measure of every attack or an estimate of payment success. They should not be used to predict how likely a present-day victim is to recover files after paying.
Build a recovery position before the next incident
Make backups difficult to destroy
Maintain offline, encrypted copies and separate the backup administration from ordinary user accounts. Keep more than one recovery point where the organization’s risk requires it, and document who can restore each system. Test restoration in a disaster-recovery exercise; a backup that has never been restored is an assumption, not a recovery capability.
Prepare golden images and a rebuild order
Document clean images, software dependencies, configuration data, identity services and contacts. Define which systems are restored first and how they are kept segmented while monitoring is re-established.
Write the contacts and decisions down
Keep current contact details for incident response, legal counsel, insurers, law enforcement and relevant government agencies. Predefine who can isolate systems, approve public communications, preserve evidence and authorize restoration. A written plan shortens the time between detection and containment.
Exercise the plan
Run tabletop scenarios that include encryption, suspected data theft, unavailable backups and a demand deadline. Record where evidence handling, supplier coordination, notification decisions and restoration sequencing fail, then update the plan.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →A concise decision checklist
- Contain: isolate affected systems and protect backup infrastructure.
- Preserve: save the ransom note, logs, contacts, wallet details, file extensions and timeline.
- Escalate: engage qualified responders, counsel, insurers and appropriate authorities.
- Assess: determine operational impact, possible exfiltration, backup integrity and the likely variant.
- Recover: seek a trusted variant-specific decryptor, rebuild from known-good images and restore tested backups.
- Comply: check sanctions, reporting, privacy, contractual and insurance obligations before any transaction.
- Report: notify the FBI, IC3 or CISA as applicable, whether or not payment occurs.
- Learn: document the timeline and improve offline backups, restoration tests and response procedures.
The central decision remains the same: a ransom is a demand, not a recovery guarantee. Containment, evidence preservation, expert assistance, clean restoration and lawful reporting give an organization a defensible path that payment alone cannot provide.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
