Cost of Paying Ransoms: Why Payers Still Lose

The Ransom Is Not the Cost

When organisations evaluate ransomware risk, they often frame it as a financial calculation: the cost of paying versus the cost of not paying. This framing is fundamentally wrong because the ransom payment is the smallest component of the total cost.

Research consistently shows that the total cost of a ransomware incident for organisations that pay the ransom is two to three times higher than for organisations that recover independently. Paying does not end the incident. It extends it.

The True Cost Breakdown

The Ransom Payment

The median ransom payment for UK organisations in 2024 exceeded £200,000. But this is the beginning, not the end, of the financial impact.

Recovery Costs After Payment

Paying the ransom does not restore your systems. Decryption tools provided by attackers are notoriously unreliable, with success rates often below 65%. Organisations that pay typically still need to rebuild significant portions of their infrastructure from backups or from scratch.

Extended Downtime

Organisations that pay ransoms experience average downtime of 22 days. Organisations that recover from offline backups and credentials average 5 to 7 days. The additional downtime directly translates to lost revenue, productivity, and customer trust.

Repeat Targeting

Organisations that pay are 80% more likely to be attacked again within 12 months. Attackers share intelligence about which organisations pay, creating a target list that circulates through criminal networks.

Regulatory Consequences

The ICO does not treat ransom payment as a mitigating factor. In fact, payment may attract additional scrutiny, particularly if it involves transferring funds to sanctioned entities. The Office of Financial Sanctions Implementation (OFSI) has issued guidance making clear that ransom payments to sanctioned groups may constitute a criminal offence.

Insurance Implications

Many cyber insurance policies now exclude or limit ransom payment coverage. Policies that do cover ransoms may require evidence that the organisation exhausted all recovery alternatives before payment, making recovery independence a prerequisite for claims.

Why Organisations Pay Anyway

Organisations do not pay ransoms because it is a good decision. They pay because they have no alternative. Their recovery credentials are encrypted. Their procedures are inaccessible. Their backup systems require authentication through compromised infrastructure. Payment is not a strategy. It is the absence of one.

The Recovery Independence Alternative

Every reason organisations pay ransoms traces back to the same root cause: recovery dependency on connected systems. Eliminate this dependency, and the ransom calculation changes fundamentally:

• Recovery credentials offline: Your team can access backup systems and cloud consoles regardless of what the attacker encrypted
• Procedures offline: Your team knows exactly what to do, in what order, because the playbook survived the attack
• Communication offline: Your team can coordinate without depending on corporate email or messaging

When recovery is possible without paying, the ransom demand becomes irrelevant. The attacker's leverage evaporates.

The Numbers

• Average total cost with payment: £1.2 million (ransom plus recovery plus downtime plus consequential losses)
• Average total cost with independent recovery: £340,000 (recovery effort plus limited downtime)
• Annual cost of offline secure storage: A fraction of either figure

Conclusion

Paying a ransom is not a recovery strategy. It is the most expensive, least reliable, and most damaging option available. Recovery independence through offline secure storage eliminates the need to pay by ensuring that the credentials, procedures, and documentation needed for recovery survive any attack. The investment in prevention is a fraction of the cost of capitulation.