The UK government is considering banning public organizations from paying ransomware demands as it seeks to strike a "significant blow” to cyber criminal operating models.
The consultation follows a series of serious ransomware incidents at NHS bodies, the British Library, Royal Mail and more, that have caused severe real world disruption and cost millions in recovery costs.
Consultation documents from government officials noted that ransomware is considered the "greatest of all serious and organized cyber crime threats, the largest cybersecurity threat, and is treated as a risk to the UK's national security."
To fight back, the Home Office is running a consultation centered around three proposals.
These include mandatory requirements to report ransomware incidents and a ransomware payment prevention scheme that would require notification of intention to pay and offer support to help victims avoid paying.
The government already prohibits ransomware payments by its own departments, and the third option would seek to extend that across all public bodies — including the NHS — and organizations deemed critical national infrastructure (CNI) and perhaps even their suppliers.
One consideration, the consultation report notes, is coming up with the right measures to encourage compliance with the ban — in other words, how to punish any public or CNI organisation that pays ransomware criminals.
The consultation is considering making non-compliance a criminal offence or making use of civil penalties, such as fines or banning leadership from being a member of a board.
However, the consultation document notes: "The Home Office welcomes views on other measures that could be used to encourage compliance with the ban."
Fighting back against ransomware
The aim of the legislation is to deter future ransomware attacks by cutting down the amount of money threat groups earn as well as to make it easier for authorities to disrupt and investigate attacks, the government said.
"Reducing the spread of ransomware attacks, and undermining the criminals’ business model, requires an entirely new approach, and one that will help the UK to lead the world in fighting back against the increasing risks posed by this crime to our society and economy,” the report states.
Because of that, tackling the threat of ransomware requires a coordinated approach.
"With an estimated $1bn flowing to ransomware criminals globally in 2023, it is vital we act to protect national security," said security minister Dan Jarvis.
"These proposals help us meet the scale of the ransomware threat, hitting these criminal networks in their wallets and cutting off the key financial pipeline they rely upon to operate."
The consultation runs until April.
Does paying ransoms work?
Paying ransoms to threat actors can be a dangerous option for organizations that have fallen prey to a cyber attack. Despite paying, research shows many victims find they cannot recover all stolen data, and in some instances threat actors have still leaked sensitive information.
RELATED WHITEPAPER
The National Cyber Security Centre (NCSC) has previously said it does not believe such ransoms should be paid, but doing so is not illegal unless the victim is aware that the money is funding terrorism.
"This consultation marks a vital step in our efforts to protect the UK from the crippling effects of ransomware attacks and the associated economic and societal costs," said Richard Horne, CEO of the NCSC.
The consultation is only targeted at public organisations or those organisations deemed to have critical national infrastructure, but previous research has suggested as many as a third of private companies have paid out to ransomware groups.
-
Security experts issue warning over the rise of 'gray bot' AI web scrapersNews While not malicious, the bots can overwhelm web applications in a way similar to bad actors
-
Does speech recognition have a future in business tech?Once a simple tool for dictation, speech recognition is being revolutionized by AI to improve customer experiences and drive inclusivity in the workforce
-
Law enforcement needs to fight fire with fire on AI threatsNews UK law enforcement agencies have been urged to employ a more proactive approach to AI-related cyber crime as threats posed by the technology accelerate.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
-
Have I Been Pwned owner Troy Hunt’s mailing list compromised in phishing attackTroy Hunt, the security blogger behind data-breach site Have I Been Pwned, has fallen victim to a phishing attack targeting his email subscriber list.
-
Alleged LockBit developer extradited to the USNews A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
-
February was the worst month on record for ransomware attacks – and one threat group had a field dayNews February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impactedNews The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
-
300 days under the radar: How Volt Typhoon eluded detection in the US electric grid for nearly a yearAnalysis Lengthy OT lifespans give attackers time to penetrate networks underpinning critical infrastructure and plan future disruption
-
Cybersecurity teams face unparalleled pressure, but they’re stepping up to the plateNews While cybersecurity teams are contending with rising workloads and chronic staffing issues, new research shows practitioners are still charging ahead and meeting targets.
