Potential Ban on Ransomware Payments for UK Businesses

Ransomware attacks have caused significant disruption to businesses of all sizes for years. Still fresh in the mind is last year’s NHS pathology data breach. NHS England confirmed that patient data managed by pathology testing organisation Synnovis was stolen in a ransomware attack on the 3rd June 2024.

However, the UK government is now considering a ban on public sector organisations making ransomware payments. This potential move aims to disrupt the business model of cyber criminals and prevent public funds from fuelling further attacks. But what does this mean from a cyber security perspective?

The Drive Behind the Proposed Ban

The surge in ransomware attacks targeting public sector organisations has prompted action at the highest levels of government. In recent years, high-profile attacks on local councils, schools, hospitals, and other critical national infrastructure organisations have crippled services and cost millions of pounds. Thus, the UK’s Home Office and the National Cyber Security Centre (NCSC) are currently in discussions to potentially implement a law that prohibits public sector entities from paying these ransoms.

The move follows guidance already issued by the NCSC, which advises against paying ransoms as it encourages further criminal activity with no guarantee that stolen data will be returned. A formal ban would codify this stance into law, limiting the response options available to public bodies when ransomware incidents occur.

How Ransomware and Payments Work

Ransomware is malicious software that encrypts an organisation’s data, rendering it inaccessible until a ransom is paid. Criminals often demand payment in cryptocurrencies to remain anonymous. The attack typically begins with phishing emails, unpatched software vulnerabilities, or compromised credentials. Once a malicious actor introduces the malware to the network via automated or manual methods, it spreads rapidly and encrypts files and locks systems.

When a ransom demand is issued, organisations then must answer the dreaded question – to pay, or not to pay? If they pay, they can only hope that the attackers take no further action… if they refuse, they risk prolonged downtime, data loss, and reputational damage.

We at Cyro, along with the NCSC, advise that best practice is NOT to pay ransoms because it incentivises criminals. Therefore, other critical controls, processes and adequate preparation is a must, without which recovery can be arduous and costly.

What Could the Potential Ban Mean for Cyber Security Professionals?

Primarily, it will provide a huge shift in mindset for both attackers and victims. For the attackers, removing the incentive of easy payouts could make public sector organisations less attractive targets. If they know that public entities cannot legally pay, criminals may redirect their efforts toward less constrained private sector targets.

For victims, there will be less ambiguity regarding what they should do if/when they are targeted, in what’s historically been a ‘hush hush’ situation. Clear legal guidance eliminates the dilemma of whether to pay, thus streamlining decision-making processes and strengthening the national cyber security posture.

We at Cyro have spoken to numerous organisations who don’t consider proactive approaches until it’s too late. However, this payment ban would force organisations to move away from a reactive approach and prioritise these proactive security measures, including robust backup strategies, real-time endpoint and environment monitoring, incident response planning, and employee training to mitigate ransomware risk, strengthening their overall security posture.

Could It Work?

At Cyro Cyber, we believe the efficacy of a ransomware payment ban is uncertain. While it’s by no means a perfect solution, it’s certainly a step in the right direction, especially for UK based public sector organisations, who are amongst some of the most vulnerable. Entities like the NHS and local councils often operate vast networks built on legacy systems. This is often because financial constraints limit their ability to modernise and adopt robust cyber security measures. Thus, while private sector targets may offer higher payouts, public bodies are often easier to exploit, as criminals can ‘get rich quick.’

The criticality of public sector services and the risk to public safety and operation also creates intense pressure to resolve incidents quickly, even when backup systems are in place. In this context, ethical and practical dilemmas become acute. When faced with media scrutiny, critical downtime, and personal accountability, leaders may be tempted to pay the ransom despite legal risks. The immediate costs of compliance with a ban could seem higher than the expense of rebuilding from scratch. Therefore, a ban of this nature can alleviate some of this pressure and certainly act as a strong deterrent.

However, the nature of ransomware attacks plays a significant role in determining its potential impact.

• Targeted Attacks: These involve careful profiling of victims to ensure a ransom demand is likely to be paid. A ban could deter some attackers if they know payment is illegal, but proving this effect is challenging because successful targeted attacks generate less noise and fewer public disclosures.

• Opportunistic Attacks: Many ransomware groups cast a wide net, relying on broad campaigns to find victims. For these attackers, a ban may have minimal impact, as they are often unaware of country-specific payment restrictions.

Without international agreement, cyber criminals are likely to instead exploit jurisdictions where payments remain legal. As such, while there may be benefits to the UK with this ban, if the end goal is global security, then global coordination and a united front is essential.

We mustn’t forget also that ransomware operations have a long "collective memory" for profitable strategies. Even if stricter laws temporarily reduce payouts, the perception that ransomware works will persist. Like call centre scams that endure despite decades of countermeasures, profitable cybercrime tactics simply evolve rather than disappear.

Conclusion

To ban or not to ban? That is the question. It seems that there are equal amounts of pros and cons in doing so.

It’s possible that a ban of this nature simply displaces attacks from public bodies to private sector organisations where no such prohibition exists. The moral argument is compelling - taxpayer money funding criminal operations is indefensible. Yet, in an interconnected world with extensive outsourcing and third-party IT providers, defining the boundary between public sector entities and their service providers becomes challenging. If criminals encounter stronger defences and legal barriers to ransom payments, they may pivot to more destructive tactics, such as stealing sensitive customer data for fraud or holding individuals’ medical records for ransom.

The UK’s consideration of a ransomware payment ban for public sector bodies marks a significant moment in the fight against cybercrime. While the measure carries potential benefits, its success will hinge on preparedness, enforcement, and broader systemic improvements to cyber security practices.

How Can We Help?

At Cyro Cyber, we help organisations fortify their defences against ransomware attacks with cutting-edge threat intelligence, robust incident response strategies, and tailored recovery plans. Contact us today to learn how we can help you build resilience and stay ahead of evolving cyber threats.