Ransomware economics and response decisions

For most of its history, ransomware was an availability attack. The criminals encrypted your files and sold you the key. An organisation with good backups could refuse to pay, restore, and move on. That world is gone. Attackers watched victims recover from backups and changed the model so that recovery no longer buys silence.

The first change was double extortion: steal a copy of the data before encrypting it, then threaten to publish it unless paid. A restored backup does nothing about the stolen copy, so the threat survives your recovery. Groups then added a third and a fourth form of pressure: denial-of-service attacks to knock you offline during negotiations, and direct harassment of your customers, patients or staff whose records were taken. The newest variant drops encryption entirely. An extortion-only attack never locks a single file. The criminals quietly exfiltrate the data and go straight to the threat to leak, because that is the part that actually pays.

The evidence backs the shift. ENISA’s Threat Landscape 2025 records that around 77 per cent of 2025 ransomware attacks involved data exfiltration. The asset genuinely at risk moved from availability, which backups protect, to confidentiality, which they do not. The control set has to move with it: data minimisation so there is less to steal, encryption at rest so a stolen copy is harder to read, and detection tuned to catch data leaving the building rather than only catching files being locked. The figure below traces the five stages and, at each one, the answer that actually addresses the pressure being applied.

The headline statistic is that far fewer victims pay. The incident response firm Coveware reports that about 23 per cent of victims paid in the third quarter of 2025, down from around 85 per cent in 2019. Refusing to pay is now the statistical norm, which changes the negotiation itself: the criminals know most targets will walk away, so their opening demands and their willingness to bluff both shift.

Two numbers have to be read together, or you will draw the wrong conclusion. Chainalysis, which traces payments across the public blockchain, found that total ransom payments fell by about 35 per cent to roughly 813 million US dollars in 2024. Fewer victims paying pushed the total down. Yet the payments that still happen are concentrating into larger sums aimed at organisations that cannot tolerate downtime and have the means to pay. A falling payment rate does not mean ransomware is becoming less profitable per successful extortion; it means the criminals are being more selective about whom they squeeze.

The supplier side fragmented too. After the international takedowns of LockBit in early 2024 and ALPHV, the market did not shrink so much as splinter, with around 85 active groups counted by the third quarter of 2025. Enforcement disrupts brands and reputations, which matters, but it does not remove the underlying economics. As long as stolen data has value and some victims can be pressured into paying, new affiliates assemble around whatever tooling is available.

When an extortion demand lands, an organisation faces a decision it never wanted, under time pressure, with incomplete information. The single worst way to take it is to open the debate on the night of the incident. The decision should already exist as a written procedure, agreed in calm conditions, that a named authority walks through. Treat it as a sequence of gates, each of which can stop a payment on its own.

The first gate is legality. Paying a group that is a designated entity can itself be a criminal offence. In the UK the Office of Financial Sanctions Implementation enforces financial sanctions, so OFSIexposure, alongside the United States Office of Foreign Assets Control for any dollar-denominated payment, has to be checked before anything moves. This is the module’s core idea of sanctions exposure: the risk that the recipient of a ransom is a sanctioned party, which turns a commercial decision into a legal one. The second gate is insurer consent. A cyber insurance policy that would fund a payment almost always requires the insurer to approve it first; paying without that written approval can void the cover you were relying on. The remaining gates test the value of paying at all: will a decryptor actually restore service at production scale, what evidence exists that stolen data will genuinely be deleted rather than resold, and has the one named board authority signed the decision off. Payment guarantees neither recovery nor deletion, so both must be argued on evidence, not hope.

Every gate also names who must be told when it fails, because the failure is itself information that other people need: legal, the insurer, the recovery lead, the data protection officer, the board. Drawing the decision this way turns a panicked argument into a checklist that can be rehearsed in a tabletop exercise long before it is needed.

The 22 July 2025 Government response set a direction that changes the whole calculation for regulated bodies. The targeted ban removes payment as an option for the public sector and critical national infrastructure operators. The payment prevention regime requires other organisations to notify and engage the authorities before any payment, so even where paying remains lawful it is no longer a private commercial choice made quietly. Mandatory incident reporting means the state gains visibility of attacks that were previously settled in silence.

For a critical infrastructure operator the practical effect is stark. The question at the board table moves from “would we pay?” to “we may not pay”. Once payment is off the table, the only plan that survives contact with a serious attack is the ability to restore and keep operating without the criminals’ cooperation. That is why the next module treats resilience and recovery as a first-class capability rather than a storage-administration afterthought: the law is making resilience the whole answer, not the fallback.

None of this ends the exfiltration threat. Even a body that restores perfectly still has to manage the leak of whatever was stolen, with its data protection, regulatory notification and communications duties intact. The policy shift does not make ransomware easier. It removes the escape hatch that let organisations avoid building the resilience they needed all along.