Paying a ransomware demand does not always lead to the return of an organization's files, the prevention of data leaks, or the eradication of attackers from its network, according to digital forensics and incident response companies.
Ransomware is a prevalent cybersecurity risk, and according to a 2025 CrowdStrike report, 78% of 1,100 global IT and cybersecurity leaders asked about attacks in the past year.
In addition, according to a report by Proofpoint, which appeared in July, 54% of the 1,600 organizations surveyed worldwide said they had paid a ransom within the last year.
Joe Hoosech, an executive at the cybersecurity insurance company Cowbell, estimates that paying the ransom retrieves data with no further leaks in 75 to 80% of cases.
Some hackers do indeed honor their word to deter potential victims by building a reputation as reliable businesspeople, he adds. In addition, they sometimes provide documents describing how they penetrated the network, although experts say this information is often of little value.
"Sometimes the decryptor doesn't work," Hosech cautions. "In my experience, maybe one out of four organizations finds that the decryption tool does not completely restore all the data." Andrew von Ramin Mapp of Cyber Centaurs has observed a similar challenge: "Sometimes there is some damage to the database, for example, because the encryption tool was run while the database was open, so the database needs to be fixed."
Beyond restoring data, organizations must consider whetherransomware attackers have deleted evidence of the breach, experts say, citing an example. "I've had clients where the bad guys took the data, encrypted it, and then left," recalls Eric Taylor of Barricade Cyber Solutions. "The client paid the ransom, the bad guys promised to delete it, and then the client saw the data on the bad guys' website, including the files they had deleted."
"Sometimes the bad guys take the data for themselves and sell it to others," Hoosech says.
Initial access brokers can infiltrate networks and sell that access to other threat groups and stay in the network. "Therefore, just because one gang promises to protect you, it doesn't mean that those who purchased access to your network won't benefit from stealing your data," says Taylor.
"Instead, companies should evaluate the value of the data to the organization and the impact on the business of losing or disclosing it," recommends von Ramin Mapp. He advises businesses that have decided to pay a ransom to "test the decryption key before handing over the ransom."
However, the expert says there is no way for organizations to receive absolute guarantees that the data will be deleted.
"By the way, I advise companies to keep their cyber insurance policies on paper and in a safe place," says von Ramin Mapp. "If an attacker accesses your computer system and finds where you keep the documents, he can calculate how much you might be willing to pay to stop them."
Still, experts say that while the ransomware payment option does not completely eliminate the need to respond to the attack, organizations should continue to investigate and mitigate ongoing attacks.
Read the original article: