Every executive who has ever stared down a ransom note understands the seductive logic of paying. The data is encrypted, the operations are frozen, the customers are angry, and a Bitcoin wallet address sits at the bottom of the email like an emergency exit. The arithmetic looks simple: pay seven figures now, recover in days, move on. The trouble with that arithmetic is that it is wrong in almost every dimension that matters, and the evidence has become impossible to ignore. A ransomware payment is not the end of the incident. It is the beginning of a far more expensive one.
According to the Sophos State of Ransomware 2024 report, organizations that paid the ransom recovered an average of only 65% of their encrypted data, and the median total recovery cost reached USD 2.73 million — significantly higher than for organizations that refused to pay and rebuilt from backups. The IBM Cost of a Data Breach Report 2024 reinforces the pattern: paying does not shorten breach lifecycles in any statistically meaningful way. The myth that paying is the fast lane to recovery is dead. What replaces it is a rigorous understanding of why a ransomware payment is the most expensive decision a board can make, and what enterprises should do instead.
The True Economics of a Ransomware Payment
The ransom demand is the headline number, but it is rarely the largest cost. It is the line that boards see first and forget last.
Chainalysis tracked USD 1.1 billion in confirmed ransomware payments globally in 2023, the highest annual total ever recorded. Verizon’s 2024 Data Breach Investigations Report (DBIR) found that ransomware now appears in roughly one third of all breaches, and the median ransom demand for impacted organizations climbed to USD 46,000 — a figure that doubles or triples once business interruption, incident response, regulatory response, and reputational repair are included. Coveware’s Q4 2023 Ransomware Report places the average ransom paid at USD 568,705 across the cases it managed.
The ransom is the smallest line on a much longer invoice. The real bill arrives over the eighteen months that follow, in the form of customer churn, regulatory penalties, shareholder litigation, and a security overhaul that should have happened years earlier.
Seven Reasons a Ransomware Payment Fails the Cost-Benefit Test
- Decryption rarely restores everything. Sophos data shows roughly one third of paid decryptions leave persistent corruption, missing files, or unbootable systems. Recovery still requires the rebuild that paying was supposed to avoid.
- You become a known payer. Ransomware affiliates share telemetry on which organizations paid. According to a 2024 Mandiant M-Trends report, 78% of organizations that paid a first ransom were re-attacked within twelve months, and a third paid again.
- OFAC sanctions exposure. A growing share of ransomware groups operate under US Office of Foreign Assets Control sanctions. Paying a sanctioned actor — even unknowingly — can expose directors and officers to federal penalties under 31 CFR § 596.
- Cyber insurance is pulling back. Lloyd’s of London announced in 2023 that several syndicates would no longer cover state-sponsored cyber incidents, and AXA stopped reimbursing ransom payments outright in France. Insurance has stopped being the safety net executives assume.
- Data is not really returned. The 2023 LockBit takedown by international law enforcement revealed that the group retained victim data even after payments were made and decryption keys delivered. Paying buys silence, not deletion.
- Shareholder and customer litigation follows. Following the 2024 Change Healthcare incident, plaintiff law firms filed more than fifty class actions in under ninety days. Payment did not prevent any of them.
- Regulatory disclosure now mandates transparency. The US Securities and Exchange Commission’s 2023 cyber disclosure rule and CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act) increasingly require public disclosure of payments. The reputational hit a payment was supposed to avoid arrives anyway.
Paying transfers funds to organized criminal enterprises, fuels the next campaign against the next victim, and signals to your board that the security investments they declined to fund last year now must be funded under emergency conditions.
Adapted from the FBI Internet Crime Complaint Center 2023 guidance to victims
Three Real-World Scenarios That Define the Modern Ransomware Era
Scenario 1 — Change Healthcare and the Limit of Paying
In February 2024, the BlackCat (ALPHV) ransomware affiliate breached Change Healthcare, a UnitedHealth Group subsidiary processing roughly fifteen billion medical transactions per year. UnitedHealth disclosed in subsequent SEC filings that it paid the attackers approximately USD 22 million in Bitcoin.
The payment did not end the incident. A second ransomware affiliate, RansomHub, claimed in April 2024 to still possess copies of the same data and demanded another payment. Total disclosed losses for UnitedHealth crossed USD 2.4 billion in 2024 alone, with patient data of roughly one third of Americans confirmed exfiltrated. The case illustrates a doctrine the FBI now restates publicly: paying does not guarantee data deletion.
Scenario 2 — JBS Foods and the Insurance Calculus
In May 2021, the REvil ransomware group disabled JBS, the largest meat processor in the world, halting operations across the United States, Canada, and Australia for several days. JBS paid USD 11 million in Bitcoin. Recovery completed within a week.
Within months, JBS faced increased cyber-insurance premiums, regulatory scrutiny in three countries, and a forced security overhaul that ultimately cost more than the ransom itself. REvil affiliates were later indicted by the US Department of Justice; some of the paid Bitcoin was eventually recovered, but the operational lesson stood: even when payment “works,” the post-incident cost trajectory continues for years.
Scenario 3 — Caesars Entertainment and the Disclosure Reality
In September 2023, the Scattered Spider threat group used social-engineering against a Caesars IT vendor, escalated into the company’s environment, and demanded ransom. Caesars reportedly paid approximately USD 15 million, half the original demand.
The company disclosed the breach in an 8-K filing under the new SEC rules, triggering a stock-price decline and a class action filed within ten days. The same threat group also breached MGM Resorts that month, where MGM refused to pay and incurred direct losses of around USD 100 million. The comparative outcome — Caesars paid and Caesars was sued; MGM did not pay and MGM was sued — undermines the core premise that paying buys peace.
What Boards Should Do Instead of Paying
The point of a mature ransomware program is to make payment unnecessary, not to make it cheaper. iSECTECH structures resilience programs around five board-level imperatives.
- Tested, immutable, offline backups. NIST SP 800-209 and the CISA Stop Ransomware initiative converge on the same baseline: 3-2-1-1-0 backup strategy with at least one immutable, air-gapped copy and zero errors on quarterly restoration tests.
- Identity-first segmentation. Most ransomware propagates through over-permissioned domain accounts. Implementing tiered Active Directory administration, just-in-time elevation, and Zero Trust network access reduces blast radius from “global” to “single host.”
- Endpoint detection and response with managed hunt. A 24/7 EDR-driven SOC, internal or via MSSP, dramatically increases the chance of stopping ransomware before encryption begins. Median dwell time in 2024 fell to ten days, but human-operated response can compress that to under sixty minutes.
- A rehearsed crisis playbook. The teams that recover fastest are the teams that have walked the playbook in tabletop. Legal, communications, finance, executive, and technical functions need to know what they will do at hour one, hour twelve, and hour seventy-two of a ransomware event.
- A board-level no-payment posture. The decision to pay should be made before the breach, not during it, after legal review of OFAC exposure, insurance coverage, and disclosure obligations. Most CISOs who establish this posture in advance never need to revisit it.
Resilience is not the absence of incidents. It is the capacity to absorb one without paying the people who caused it.
The Bottom Line
A ransomware payment is the financial equivalent of putting out a fire by spraying it with gasoline that you have personally paid for. It buys minutes of relief, funds the next campaign against the next victim, and triggers a cost trajectory that lasts years. The enterprises that survive this decade will be those that treat ransomware as a resilience problem, not a payment problem — investing in backups, identity, detection, and rehearsed response so that paying is never the rational choice. iSECTECH’s analysis of how phishing initiates these breaches and our insider-threat research map the upstream entry points every ransomware program must close. For the federal-government posture on payment, see the CISA Stop Ransomware initiative and the FBI IC3 ransomware advisory.