What happens after a company pays a ransom?

Sponsored by

Your AI strategy has a security problem: 43% of IT leaders now cite security concerns as the top barrier to expanding AI agent deployment, according to research from JumpCloud. Before giving agents more access to apps, data, and workflows, make sure you can govern the identities behind them. See how to secure every identity, human or not.

We have encrypted your systems. Pay $20M in Bitcoin or we will leak your data.

Some may recognize the above as the introduction to our interactive Block the Breach game. For others, that nefarious text might be a very real reminder of a time when their organization was hit by ransomware, and they had to pay a significant amount of money to bring their systems back online.

Ransomware attacks remain a huge issue. A 2025 CrowdStrike report surveying 1,100 global IT and cybersecurity leaders found that 78% of global organizations experienced a ransomware attack in the preceding 12 months.

It’s not uncommon for businesses to succumb to an attacker’s financial demands. A July Proofpoint report found that more than half (54%) of organizations surveyed across the globe paid a ransom in the past year.

But what happens after a company agrees to pay a ransom? We caught up with digital forensics and incident response (DFIR) professionals to find out.

A happy ending? Eric Taylor, owner of Barricade Cyber Solutions, a cybersecurity firm that provides DFIR services to small to medium-size businesses, said an ideal scenario after paying a ransom would be for the cybercriminals to cough up a decryptor tool, which is then tested in a sandbox to ensure there aren’t any hidden malicious payloads or scripts.

“The promise that the threat actor makes is, ‘Hey, we’re not going to attack you anymore. We’ll delete all your data,’” Taylor said.

Joe Hoosech, principal of DFIR at AI-native cybersecurity insurance company Cowbell, added that threat actors may accompany the decryptor with a complimentary security report.

“That report is given, and it lays out exactly how they compromised the environment, how they got in, and what they were able to do while they were in there,” Hoosech said. “That, to them, is their deliverable, if you will, on that ransom payment.” (However, Taylor mentioned that these documents tend to be a “boilerplate type of report,” offering no real value.)

Hoosech estimates that the outcome where data is decrypted and not leaked occurs 75% to 80% of the time for organizations that ultimately pay up to cybercriminals. He said this may be because some threat groups try to uphold their end of the bargain to maintain their image.

“As silly as it sounds, threat actor groups try to keep their reputational score up, just because if the word gets out that their decryptor doesn’t work, or they’re leaking data, or they’re re-extorting, then it lessens the likelihood of payment the first time,” Hoosech said. “So, they try to keep their reputation as a good organization. As good as a threat actor could be.”

Things fall apart. Not every organization is lucky enough to successfully decrypt their data following a ransom payment. In roughly a quarter of cases, Hoosech said, the decryptor may fail, even after threat actor groups provide proof of function.

“It doesn’t mean that they don’t get some of their data back. They just don’t get all of their data unencrypted,” Hoosech said. “And oftentimes, we see that with some proprietary files that the client may have that aren’t normal Excel, Word, PDF, JPEGs.”

Andrew von Ramin Mapp, a managing principal at DFIR firm Cyber Centaurs, said corrupted databases are the most common undesirable scenario he sees from organizations that pay ransoms.

“That’s not something nefariously that the ransomware group planned. It’s just the way the technology works,” von Ramin Mapp said. “Databases are live streaming. They’re not meant to be interrupted in the middle of operations.”

Depending on the threat actor, “we have seen situations where they’re actually willing to provide support. In other scenarios, a repair procedure needs to be done on the databases or the virtual machines to get them up and functioning again,” von Ramin Mapp added.

There’s also always the risk that threat actor groups won’t uphold their promise to delete an organization’s data following payment, Taylor said. He recalled an example where one company paid a threat actor group to delete their data, but later found leaked files and the deleted file list posted on their website.

It’s important to note that several threat actor groups leverage initial access brokers (IABs), threat actors who initially obtain unauthorized access to a corporate network and sell it to other attackers. Taylor has seen instances where IABs linger in a company’s environment after a ransom has been paid.

“While [the threat group] can say, ‘We won’t attack you anymore,’ they can’t speak for the IAB, the initial access broker, because we have seen before in recent cases earlier this year where the initial access broker was still inside the environment, monitoring what they were doing,” Taylor said.

Things to consider. For companies debating whether or not to pay a ransom, Taylor said to treat the choice as a business decision and assess the value of the data at stake.

“Family pictures…those files getting encrypted would suck, but it’s not the end of the day. But, patient files are a different story,” Taylor said. “Not all data is the same, so you got to take an evaluation of the data that’s been hit and encrypted and the data that’s been leaked, and make a business decision off of those facts.”

Once the decision has been made to pay, Hoosech said that organizations should verify that decryption tools work before sending payment, and warned that there’s no real way to verify data deletion claims: “That’s one of the things that they they’ll normally say is, ‘If you pay the ransom, we’ll delete your data and we won’t post it anywhere or sell it to anybody.’ But, you can never have 100% proof that that has happened.”

Finally, von Ramin Mapp advised against keeping a copy of your organization’s cyber insurance policy on a network; if it’s found, ransomware groups can use it as a benchmark for how high to set their ransom.

“Have the CEO or CFO have a hard copy of that, store that somewhere in a safe and keep it far away from the network,” von Ramin Mapp said. “If you have to have a digital copy, put it on a flash drive and put that somewhere in a safe.”