It’s your decision, and sometimes businesses do pay. But it should be the last option, taken with full information. Here is what to weigh.
The risks of paying
- The decryptor may not work. Attackers’ decryption tools are often slow, buggy or fail on large files such as databases and virtual machines
- It can be illegal. The US Treasury’s Office of Foreign Assets Control (OFAC) has warned that paying a group on the sanctions list can break US sanctions law, even if you didn’t know who they were
- Data theft continues. Most groups steal data before encrypting it. Paying doesn’t guarantee they delete it
- You become a target. Businesses that pay are more likely to be attacked again
Check these first
- Is there a backup, snapshot or cloud copy the attackers missed?
- Are large files only partly encrypted? Databases and virtual machines often are
- Is there a free decryptor for this strain?
- Can deleted originals be recovered from the disks?
We answer those questions quickly, so the decision is made on facts. If you do decide to pay, involve your insurer, legal counsel and a specialist negotiator, and report the attack to the FBI.
Start your recovery
Book online for a job number and shipping instructions, or call and talk to an engineer. We evaluate the drive and give you a fixed quote before any recovery work starts.