Short answer: usually no. The FBI says it does not support paying a ransomware ransom because payment does not guarantee a usable decryption key, does not ensure stolen data will stay private, and can encourage further attacks. Treat a ransomware incident as a response and recovery problem: contain the compromise, preserve evidence, involve qualified responders and authorities, check clean backups and variant-specific decryptors, and rebuild from trusted systems. For a U.S.-connected incident, obtain sanctions and legal advice before any transaction.
What the FBI’s position means
The Federal Bureau of Investigation’s public guidance is unambiguous: “The FBI does not support paying a ransom in response to a ransomware attack.” Its reason is practical as well as policy-based. “Paying a ransom doesn’t guarantee you or your organization will get any data back.” You can pay and receive no key, a broken key, or instructions that do not work for every affected system. The attacker may also keep access, demand another payment, or publish data that was copied before encryption.
As an Amazon Associate I earn from qualifying purchases.
Payment is therefore not a recovery plan. It is a transaction with criminals whose promises cannot be enforced. The FBI also warns that paying can incentivize the same group to target more victims and encourage other criminals to enter the business. The agency asks victims to report the incident whether or not they ultimately pay. Read the FBI ransomware guidance for its current reporting and response recommendations.
Why paying can fail even when a criminal sends a key
Decryption may be incomplete or impossible
Ransomware operators can lose their own decryption keys, damage files during encryption, or provide software that works only on a sample. A key may decrypt documents but not databases, virtual machines, cloud-synchronised files, or backups. Large environments can contain several variants or multiple encryption events. A payment does not repair corrupted files or restore configurations, identities, applications, and network trust.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Decryption does not remove the compromise
Attackers may leave remote-access tools, stolen credentials, scheduled tasks, or other persistence behind. Decrypting files while the intruder still has access can lead to another encryption event. Systems should be investigated, attacker access removed, and rebuilt from known-good images where appropriate. A successful decryption is not evidence that the environment is safe.
Stolen data can still be disclosed
Many incidents involve both encryption and exfiltration. Paying for a decryption key does not create a binding promise that copies of employee records, customer data, intellectual property, or credentials will be deleted. The FBI’s guidance addresses this limitation: payment cannot ensure that stolen information will not be released.
Payment strengthens the criminal market
Revenue helps operators buy infrastructure, recruit affiliates, and refine targeting. That does not make an individual victim responsible for the entire ransomware economy, but it does explain why U.S. authorities discourage payment and ask for reporting in every case. The FBI’s testimony on the subject is available at America Under Cyber Siege: Preventing and Responding to Ransomware Attacks.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Four factors that should drive an incident-specific decision
There is no responsible formula that converts these factors into a reliable “pay” or “do not pay” score. Use them to brief incident-response, legal, insurance, and executive decision-makers. They describe the situation; they do not make payment safe or guarantee recovery.
| Factor | Questions to answer | Why it matters |
|---|---|---|
| Clean, tested backups | Do offline backups exist? Were they tested in a disaster-recovery exercise? Are they from before the intrusion, and can they be scanned before use? | A verified recovery path can reduce dependence on an attacker. An untested or connected backup may be encrypted or contaminated. |
| Operational and public-safety impact | Which services are down? Could delay threaten life, safety, patient care, essential utilities, or contractual continuity? | Downtime costs and safety obligations affect urgency, but urgency still requires legal review and does not make a ransom reliable. |
| Exfiltration claims | Does the note or evidence indicate that data was copied? What data, when, and how can the claim be validated? | Restoring encrypted files does not control information already taken. Breach response, notification, and containment must be handled separately. |
| Legal, sanctions, insurance, and contracts | Could a recipient be sanctioned? What do policy terms require? Are regulators, customers, lenders, or partners entitled to notice? | A payment or its facilitation can create sanctions and other legal exposure. Counsel should review obligations before any transaction. |
What to do in the first hours
Move deliberately. Rushed cleanup can destroy evidence, spread the malware, or overwrite the information responders need to identify the variant and entry point.
Rank #2
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
- Activate the incident-response plan. Name an incident lead and establish a secure channel that does not depend on potentially compromised email or collaboration accounts. Include IT, security, business continuity, communications, legal counsel, and the insurer if a policy requires notice.
- Isolate affected systems. Disconnect visibly encrypted endpoints and servers from wired and wireless networks where feasible. Disable suspected remote-access paths and compromised accounts under responder direction. Do not power-cycle or wipe systems automatically; volatile memory, running processes, and logs can contain evidence.
- Protect unaffected systems and backups. Segment critical networks, restrict administrative access, and disconnect backup media. Do not reconnect an external drive simply to see whether it contains usable files. Follow responder instructions before moving data between environments.
- Preserve the ransom note and technical clues. Save the note, attacker email addresses or websites, cryptocurrency wallet address, demand amount and deadline, file-extension changes, sample encrypted files, screenshots, and a timeline of alerts and outages. Keep original copies and record who collected each item.
- Call qualified responders and authorities. Organizational incidents normally warrant a qualified incident-response or digital-forensics team. U.S. victims can contact the local FBI field office or file with the Internet Crime Complaint Center (IC3), and can contact the Cybersecurity and Infrastructure Security Agency (CISA) as applicable. Reporting is appropriate whether or not payment is made.
- Determine the exact variant. Use ransom-note wording, encrypted-file extensions, malware samples, and forensic evidence. Do not trust a criminal’s label alone; an incident may involve a different family or more than one strain.
CISA’s StopRansomware: Guide, developed with MS-ISAC, NSA, and the FBI, provides operational guidance on containment, evidence, backups, and recovery.
Recovery options that do not depend on paying
Restore from known-clean offline backups
CISA recommends backups that are offline and encrypted, with availability and integrity tested in a disaster-recovery scenario. Identify the last known-good backup before the intrusion, verify that it is complete, and scan it for malware where possible. Restoration should occur into a rebuilt, monitored environment rather than onto systems that still contain attacker persistence.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteBackups are useful only if the organization can actually restore applications, identity services, configurations, and data. Test a representative recovery path, document dependencies, and retain multiple recovery points. A single connected backup target is not an offline strategy: ransomware can reach it through compromised administrator credentials or network shares.
Rebuild from trusted images
For affected servers and endpoints, responders may recommend reimaging or replacing systems, rotating credentials, patching the initial access route, and enforcing stronger authentication before data is restored. Rebuilds take longer than simply running a decryptor, but they address the possibility that malware and unauthorized accounts remain hidden.
Check for a decryptor for the exact variant
Researchers sometimes discover cryptographic flaws or obtain keys and release tools. CISA advises asking federal law enforcement or a qualified responder whether a decryptor exists for the specific variant. Availability is not universal and can change as new strains appear. Never download a supposed decryptor from an unknown forum or attacker link; it may contain another payload or steal credentials. Test any tool on copies in an isolated environment and preserve originals.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Use surviving copies and alternate records
Version histories, replicated databases, paper records, offline exports, and data held by trusted service providers may help reconstruct operations. Treat each source as potentially affected until responders verify its integrity. Recovery priorities should follow safety and essential services first, then systems needed to restore the remaining environment.
Handle data theft as a separate breach
Encryption and exfiltration are different events. Review firewall, proxy, identity, cloud, endpoint, and storage logs to determine whether large transfers occurred. Preserve evidence before log-retention periods expire. Identify what categories of information may have been accessed, whose data is involved, and which jurisdictions’ notification rules apply.
A threat actor’s leak-site claim can be exaggerated, but it cannot be dismissed without investigation. Do not negotiate over confidentiality as if a payment were enforceable. Legal counsel, privacy officers, and regulators may need to be involved even when files are eventually restored from backups.
Sanctions and legal limits in the United States
The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) says the U.S. government strongly discourages private companies and individuals from paying ransomware or extortion demands. Its updated ransomware advisory, dated September 21, 2021, warns that a payment or assistance with a payment can create risk when a sanctioned person, group, or jurisdiction is involved. Companies that facilitate a transaction can face exposure as well.
OFAC says license applications for ransomware payments are reviewed case by case with a presumption of denial. The advisory is explanatory and does not itself change the law or address every legal obligation. Sanctions designations and programs are volatile, so a U.S.-connected organization should obtain current sanctions counsel and check with relevant authorities before authorizing any transaction. Do not assume that every ransom payment is automatically illegal; the facts and counterparties matter. Other countries can impose different prohibitions, reporting duties, or licensing systems.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Insurance terms may require rapid notice, use of an approved responder, or consent before engaging a negotiator or making a payment. Contracts and sector rules can impose additional deadlines. Keep a written record of decisions, advice received, evidence reviewed, and communications with authorities.
How to report and what information to include
The FBI asks victims to report ransomware even when no payment is made. U.S. reporting routes include a local FBI field office and IC3’s ransomware reporting page. CISA’s reporting and assistance information is available through its StopRansomware guide.
- The suspected ransomware name or variant, if known.
- The encrypted-file extension and a copy of the ransom note.
- Attacker email addresses, messaging handles, websites, and wallet addresses.
- The demand amount, currency, deadline, and any payment instructions.
- When the intrusion was first noticed, when encryption began, and which systems are affected.
- Whether data theft is claimed or supported by evidence.
- Whether a payment was made, when, through whom, and for what amount.
- Relevant logs, malware samples, screenshots, and contact details for the incident lead.
Preserve original files and chain-of-custody information. Sharing a clean copy with responders is safer than repeatedly opening the attacker’s files on an affected workstation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If leaders are still considering payment
Payment should never be an improvised IT decision. Before any transaction, decision-makers should obtain written advice from incident responders, sanctions counsel, the insurer, and other required legal advisers. They should verify the recipient and payment path, assess whether the transaction could violate sanctions, and understand that no clause can guarantee decryption or deletion of stolen data.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Ask responders to document alternatives first: the quality of backups, reconstruction options, variant-specific decryptors, manual workarounds, and the consequences of extended downtime. Establish who can authorize a transaction, how evidence and reporting will continue, and how systems will be rebuilt if a key is supplied. A criminal’s countdown timer is not a substitute for a defensible decision process.
Best Value
- 【Versatile Storage Expansion – For Gaming, Work & Everyday Use】 Running out of space on your PS5 or Xbox Series X/S? This external hard drive lets you store and play PS4 / Xbox One games directly, instantly freeing up your console’s internal storage for next‑gen titles. At the same time, it handles work file backups, media libraries, and cross‑device data transfers with ease. One drive, all your needs. *（Note: PS5 / Xbox Series X|S games cannot be run or stored directly from the external hard drive. However, by offloading your PS4 / Xbox One games, you can free up valuable space for newer titles.）*
- 【Patented Silicone Sleeve – Data Protection You Can Count On】 Worried about drops? We’ve got you covered. The patented built‑in silicone sleeve acts like a shock‑absorbing armor, cushioning your drive against bumps and falls. Whether it’s important work documents, precious family photos, or hard‑earned game saves, your data deserves this level of protection.
- 【Plug & Play, Compatible with Computers & Consoles】 No complicated setup—just plug in and go. Works seamlessly with Windows, Mac, and Linux computers, as well as PS4, PS5, Xbox One, and Xbox Series X/S. Process files at the office, back up data at home, or enjoy gaming in your downtime—one drive handles all your devices, simply and hassle‑free.
- 【USB 3.0 Ultra‑Fast Transfer – No More Waiting】 Tired of watching progress bars crawl? With USB 3.0 speeds up to 5Gbps, large files transfer in seconds. Whether you’re moving work documents, transferring hundreds of gigs of games, or backing up a year’s worth of photos, you get more done in less time.
- 【Sleek, Lightweight, and Ready to Go】 Weighing just 0.16 kg—lighter than a can of soda—this compact drive features a stylish mirror‑and‑frosted finish. Toss it in your bag and go, whether you’re heading to the office, visiting a friend for a gaming session, or giving a presentation on the road.
Preparing before an attack
Build recoverable backups
Maintain multiple backup copies, including offline and encrypted media, with separate administrative credentials. Schedule restoration exercises and record how long critical services actually take to recover. A physical external hard drive can be one offline-backup option when it is disconnected except during controlled backup or restoration procedures; it cannot decrypt an active infection or guarantee recovery.
Reduce the blast radius
Segment networks, restrict privileged accounts, require phishing-resistant or other strong multifactor authentication where feasible, patch internet-facing systems, and monitor remote-access tools. Keep golden images for critical systems so rebuilds do not begin from an untrusted disk.
Write and rehearse the response plan
Define isolation authority, evidence handling, contact lists, legal escalation, public communications, alternate communication channels, and restoration priorities. Include tabletop exercises that cover both encryption and data theft. Ensure executives understand in advance that payment is not a guaranteed recovery option.
What the available statistics can—and cannot—tell you
OFAC cited FBI Internet Crime Reports for a 37 percent annual increase in reported ransomware cases from 2018 to 2019 and a 147 percent annual increase in associated losses over the same period. These are historical reported figures, not a current measure of prevalence, and they do not estimate the chance of recovering data after payment. Official sources reviewed for this guide do not establish a current, representative payment-success rate. Treat any vendor or criminal claim that promises a particular recovery percentage with skepticism.
A practical decision sequence
- Contain systems and preserve evidence.
- Notify the incident lead, insurer, qualified responders, and relevant authorities.
- Identify the variant and investigate both encryption and exfiltration.
- Verify clean backups, alternate copies, rebuild paths, and any legitimate decryptor.
- Obtain current legal and sanctions advice for the jurisdictions and counterparties involved.
- Document operational, safety, contractual, and privacy consequences of each recovery option.
- Restore into rebuilt, monitored systems and continue investigation after service resumes.
This sequence keeps the focus on recovery and risk reduction rather than on an un enforceable promise from the attacker. The FBI’s position remains the central answer: do not assume that paying will get your data back, and do not skip reporting or investigation if a payment is made.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
