Should You Pay a Ransomware or Sextortion Ransom?

If a message on your screen says your files are locked until you pay, or an email claims to hold intimate images of you unless you send money, the official advice is the same: do not pay. The National Cyber Security Centre and UK law enforcement do not encourage, endorse or condone the payment of ransom demands¹. There is no guarantee that you will get access to your data or computer, and your computer will still be infected unless you complete extensive clean-up activities².

What you do in the first hour matters more than the demand itself. Disconnect the device from the network and turn off your Wi-Fi². Do not reply to a sextortion email: forward it to the NCSC's Suspicious Email Reporting Service and then delete it³. Keep the evidence, and report through the police on 101 or Report Fraud if you have paid⁴.

Ransomware is not a rare nuisance. It has been identified by UK authorities as the number one cyber threat to the nation, and the UK is one of the most targeted countries in the world, with some estimates putting it second only to the US⁶. Households meet it mostly as a locked home computer, or as a scam email that quotes an old password. Both have a clear, calm response.

The official advice is not to pay

The position is consistent across official bodies and years. The NCSC and UK law enforcement do not encourage, endorse or condone the payment of ransom demands¹. Law enforcement does not encourage, endorse nor condone the payment of ransom demands⁷. The National Crime Agency encourages industry and the public not to pay the ransom⁸. The reasons are practical as well as principled.

• You may get nothing back. There is no guarantee that victims will get access to their data or computer⁷. Even if the ransom is paid, the victim may not regain access to all their files⁶.
• Some losses cannot be undone. Mass data loss from an attack can be irreversible, even when the ransom is paid⁹.
• The infection stays. Your computer will still be infected unless you complete extensive clean-up activities².
• You fund the criminals. You will be paying criminal groups².

Public bodies have taken the same line under pressure. Redcar and Cleveland Borough Council refused to pay the ransom, in part to protect other local authorities from similar attacks⁶. During the WannaCry attack in May 2017, the Department, NHS England and the National Crime Agency told the National Audit Office that no NHS organisation paid the ransom¹⁰.

Recovery is slow even for organisations with IT teams. A parliamentary committee heard from victims that many organisations take months to recover⁹. One participant said they were two-and-a-half years past the attack and still not fully recovered, having made the decision to rebuild systems from scratch⁶. Another reported an immediate insurance premium increase of 50%, and it took two years to return to a reasonable premium after the attack⁶. For a household, the equivalent is the time spent rebuilding files, changing passwords and watching accounts.

What to do in the first hour after a ransom demand

Ransomware is malicious software that prevents you from accessing your computer, or data stored on your computer¹¹. A criminal group will then demand a ransom in exchange for decryption¹². Normally you're asked to make a payment, in order to unlock your computer or to access your data¹¹. Payment is usually demanded via an anonymous web page and usually in a cryptocurrency, such as Bitcoin⁷.

Work through these steps in order.

1. Disconnect the device. Immediately disconnect your computer, laptop or tablet from the network, and turn off your Wi-Fi². This limits how far the infection can spread to other devices and to any connected backup.
2. Do not pay, and do not negotiate. The official advice is not to pay¹. Do not send files, passwords or identity documents to the attacker.
3. Keep the evidence. Do not wipe the device before you have noted what the message says and when it appeared. You will need this if you report it.
4. Check your backup, offline. If you have a recent offline backup, you can restore from it rather than paying⁷.
5. If there is no backup, clean the device. The NCSC advises that you safely wipe the infected devices and reinstall the operating system¹.
6. Change passwords from a different, clean device, starting with email and banking, and tell your bank if money has moved⁵.

Sextortion: stop contact, keep evidence, do not pay

A sextortion scam is an email that claims to hold images or video of you and demands payment, often in Bitcoin³. It relies on shock and a deadline. The NCSC's advice is to not engage with the criminal³. If you are unsure about an email, forward it to the NCSC's Suspicious Email Reporting Service and then delete it³. The same advice applies to phishing more broadly: do not engage with the phisher, forward the email to the Suspicious Email Reporting Service, and then delete it¹³.

Paying is the one thing that makes it worse. The NCSC warns that you might be targeted with future scams, as the criminal will know they have a willing customer³. Many of these emails are sent in bulk and the claimed images do not exist; the demand is the whole scam.

If you have paid, act quickly and keep records.

• Report it to your local police force by calling 101⁴.
• Visit Report Fraud for further advice at www.reportfraud.police.uk³.
• Keep the emails, any payment details and the times involved.
• Do not reply to follow-up demands, and do not send more money.

If images have already been shared, do not pay the ransom: the National Cyber Security Centre advises that you might be targeted with future scams, as the criminal will know they have a 'willing' customer⁴. Do not engage with the criminal, and report the matter to the police on 101, or to Report Fraud if money has been paid⁴. Keep the evidence intact so those reports can be acted on.

Where to report and get help

Reporting is not just for organisations. The true numbers of ransomware attacks in the UK each year are far higher than recorded, as organisations often do not report the compromises⁷, so every report adds to the picture.

The arrangements differ slightly across the UK. For phishing losses, the NCSC directs people in England, Wales and Northern Ireland to Report Fraud, and people in Scotland to Police Scotland⁵. The 101 number for reporting a paid sextortion demand is given without a nation qualifier⁴.

The law is also shifting for organisations, which may affect how a demand is handled if you run a business or charity. The government has consulted on three measures: a targeted ban on ransomware payments for regulated critical national infrastructure and the public sector, a ransomware payment prevention regime, and a mandatory incident reporting regime¹². These are proposals, not rules for households.

For more on the wider picture, see Ransomware: What It Is and How It Affects Households and Sextortion Emails That Quote Your Password. If you have lost money, Lost Money to a Scam: Who to Contact and What to Do sets out the next steps.

Protecting your accounts and files before it happens

The best answer to a ransom demand is a household that can restore its files without one. The NCSC says it is important to always have a recent offline backup of the most important files and data⁷. The detail that matters is the word offline: if your backup is on a USB stick, a hard drive or any type of removable media, do not leave it connected or anywhere on your network, or it may also be attacked by ransomware².

Alongside backups, a few habits reduce the chance of infection and the damage if it happens.

• Keep antivirus and malware protection installed on your computer¹⁴.
• Treat unexpected payment requests as suspect. Legitimate organisations will not contact you out of the blue to ask for payment¹⁵.
• Report scam texts rather than replying. Forwarding a scam text to 7726 costs nothing and can reduce the amount of scam texts you receive, while helping to protect others¹⁶.
• Keep a recent offline backup of your most important files. Ransomware is malicious software that prevents you from accessing your computer or the data stored on it, and having a recent offline backup of the most important files and data matters for that reason¹⁷.

Ransomware is typically experienced by businesses, charities and public sector organisations⁶, but households feel it through the services they rely on. It can cause severe disruption to the delivery of core Government services, including healthcare and child protection⁹. Locally, targets may include local government systems, healthcare providers, schools and businesses¹⁸. Ransomware remains the greatest cyber crime threat in the UK¹⁹.

For the practical steps, see Backing Up Files and Photos at Home, How to Protect Your Backups From Ransomware and Protecting Email and Bank Accounts: Passwords and 2-Step Verification. If a device is already infected, How to Restore Files Safely After Ransomware or a Virus and the After Fixing an Infected Device: Checklist take you through the clean-up.