Both the US and UK governments discourage paying ransoms. The US Treasury says it strongly discourages all private companies and citizens from paying, and the UK NCSC says it does not encourage, endorse or condone payment. Neither treats payment as a recovery plan, but the decision is still yours and your lawyers'.
What the US Treasury says
OFAC's September 2021 advisory states that the US government "strongly discourages all private companies and citizens from paying ransom or extortion demands" and recommends focusing on defensive and resilience measures. Its reasoning: payments encourage and enrich malicious actors, perpetuate and incentivise more attacks, and give no guarantee of regaining data or avoiding further attacks.
What the UK says
The NCSC page states that the NCSC and UK law enforcement "do not encourage, endorse nor condone the payment of ransom demands". It lists these risks of paying:
- Paying does not guarantee you recover your data or computer.
- The device stays infected.
- The money goes to criminal groups.
- Paying can make you a likelier target in future.
What No More Ransom says
The No More Ransom project, whose site carries Europol and Dutch police logos, says the general advice is not to pay, that paying helps confirm attacks work, and that there is no guarantee of receiving the decryption key.
Discouraged is not the same as banned
For a private company in the US, the OFAC advisory is explanatory and does not itself prohibit payment. It does warn about sanctions exposure, covered in a separate post. Rules differ by country and sector, and they change, so do not rely on a blog post for this. Get legal advice before any payment decision.
What a good decision record contains
The NCSC advises planning ransom decisions in advance. I did not confirm further NCSC wording on decision records, so check its pages directly. A sensible record, in any case, includes:
- What data and systems are affected, and what backups cover.
- Whether a free decryptor exists for this variant.
- Whether the actor may be sanctioned.
- Legal and reporting obligations.
- Who made the decision and when.
The best defence is a boring one
Every government source above lands on the same advice: invest in resilience before an attack. Tested offline backups and a rehearsed plan keep payment from being your only option.
Quick check
Is paying a ransom illegal?
Not automatically in general terms, but it can create sanctions exposure and other legal issues depending on who is paid and where you are. Ask counsel.
Does paying delete the stolen data?
No source here promises that. The NCSC lists no guarantee of recovery among the risks of paying.
Sources
Last reviewed: 19 October 2026.
