Why Businesses Should Not Pay Ransomware Demands
Explore the ethical and practical case against paying ransomware ransoms. Learn about recovery strategies, utilitarian risks, and the duty of care.
01
PAYMENT IS NOT GUARANTEED
Rebutting the assumption that paying solves the crisis
Payment does not guarantee working decryption
No guarantee stolen data will be deleted
Bluetex still faces legal & reputational damage
Paying invites repeat extortion
Payment is a gamble, not a solution
1,800 XMR
Current Ransom Demand
3,600 XMR
Delayed Payment Penalty
$700K
Specialist Decryption — No Guarantee
UNCERTAIN OUTCOME
02
SHORT-TERM RELIEF, LONG-TERM HARM
Utilitarianism requires weighing ALL consequences
Utilitarianism must consider ALL consequences
Paying funds and rewards criminal networks
Attackers aim to target hospitals, food plants & critical infrastructure
Ransom payment encourages future attacks
Short-term relief = long-term societal harm
WIDER SOCIAL HARM MATTERS
RANSOM PAID
CRIMINALS FUNDED
FUTURE ATTACKS LAUNCHED
BROADER SOCIAL HARM
HOSPITALS
FOOD PLANTS
ENERGY GRID
03
DUTY OF CARE ≠ PAY CRIMINALS
Ethical duty has better, lawful alternatives
Bluetex has a duty to protect patients — agreed
But duty of care ≠ duty to pay attackers
Paying criminals is ethically dangerous & legally risky
CIA triad argument is INCOMPLETE:
CONFIDENTIALITY
Already breached if data exfiltrated
INTEGRITY
Still uncertain post-compromise
AVAILABILITY
Improvement NOT guaranteed
THE BETTER RESPONSE
Involve law enforcement
Notify insurer & regulators
Deploy 3,000 functional backups
Prioritise 40 urgent dialysis patients/day
Manual technician visits — 40 patients/day
Forensic investigation & patching
3,000
Functional Backups Available
300/day
Internal Recovery Capacity
40/day
Manual Technician Capacity
REFUSE PAYMENT — MANAGE RECOVERY
04
FINAL REBUTTAL
Bluetex Should NOT Pay the Ransom
The opposing argument assumes payment will work — it may not
Payment is uncertain, risky and ethically compromised
Paying funds future attacks and still fails to protect data
Controlled recovery and governance is the responsible path
The responsible response is lawful recovery, patient prioritisation and stronger cyber governance — not trusting criminals.
NO RANSOM
POSITION: DO NOT PAY
- ransomware
- cybersecurity-strategy
- business-ethics
- incident-response
- data-protection
- cyber-governance