Paying a ransom is a hard decision, and law is increasingly part of it.

General information, not legal advice. Laws are evolving. Consult counsel and your insurer before any payment decision.

Approaches taken

– Reporting requirements: Australia introduced the world’s first mandatory ransomware payment reporting regime for certain businesses, effective May 30, 2025. Reports are due within 72 hours of making a payment. It doesn’t prohibit payment.

– Payment bans for certain sectors: the United Kingdom confirmed plans to ban ransom payments by public sector bodies and operators of critical national infrastructure, while requiring other businesses to notify the government before paying, plus mandatory reporting of ransomware incidents. Check the status of the legislation.

– No general ban in most places: the United States has long discouraged payments but has not imposed a national ban. Authorities warn that paying may violate sanctions rules if the recipient is a sanctioned party.

– Canada: has no general ban on ransom payments. New incident-reporting duties for designated critical infrastructure operators arrive through the Critical Cyber Systems Protection Act. Sanctions and anti-terrorism laws, privacy law (such as Law 25), and insurer requirements may also apply.

Why governments act

Payments fund criminal groups and encourage more attacks. Reporting helps law enforcement disrupt them. But critics warn that bans could push payments underground, and can leave victims, especially small ones, with fewer options.

Practical considerations

– Paying doesn’t guarantee recovery. Data may not be restored, and stolen data may still be leaked.

– Sanctions risk: professional negotiators and counsel check whether the group is sanctioned

– Insurance: many policies require notice before any payment, and coverage terms vary

– Reporting duties: incidents involving personal information may trigger legal notifications regardless of payment

– Decision framework: assess backups, legal exposure, insurer guidance, and business impact before deciding

Reduce the chance you face the decision

– Offline or immutable backups, tested

– MFA, patching, and EDR with 24/7 monitoring

– A written incident response plan, including legal and insurer contacts

– Cyber insurance reviewed for your requirements

Bottom line

The best position is one where you can restore from backup without paying. Everything else is damage control.

Sources:
https://www.cyber.gc.ca/en/guidance/ransomware
https://www.publicsafety.gc.ca/cnt/trnsprnc/brfng-mtrls/prlmntry-bndrs/20240614/18-en.aspx

DBR Soft helps businesses build recovery plans so that paying is never the only option. Contact us for more information.