← مقالات وأدلة عن الاحتيال والأمن السيبراني والخصوصية

Ransomware: pay or not? OFAC sanctions, insurance and the data

Only 28% of ransomware victims paid in 2025. What OFAC sanctions risk means, what insurers require and how to decide whether paying a ransom makes any sense.

2026-10-05

When systems go dark and a ransom note appears, every company faces the same question: pay or not? The answer involves sanctions risk, insurer requirements, reporting duties and a growing body of data showing most victims now refuse.

What the data say

Chainalysis tracked about $820 million in ransomware payments in 2025, likely to approach $900 million as more are attributed (The Record), even as claimed attacks rose about 50%. The payment rate fell to a record 28%, from 62.8% in 2024 and 78.9% in 2022, while the median payment jumped from $12,738 to about $59,500 (BleepingComputer).

Coveware saw only 23% of victims pay in Q3 2025, and 19% in data-theft-only cases, with an average payment of $376,941 and a median of $140,000 (Security Affairs). Verizon's 2025 DBIR found 64% of victims did not pay, up from 50% two years earlier, and ransomware in 44% of breaches (Help Net Security).

The shift reflects a change in the criminal business model. Coveware notes that groups such as Akira and Qilin run high-volume, low-demand campaigns against mid-sized firms, while large companies increasingly refuse to pay because a payment rarely stops stolen data from leaking. Remote access compromise featured in more than half of its Q3 2025 cases.

Source	Metric	Value
Chainalysis	2025 payment rate	28%
Chainalysis	2025 total paid	~$820m
Coveware	Q3 2025 payment rate	23%
Verizon DBIR 2025	Victims not paying	64%

Sanctions: OFAC's warning

OFAC's updated advisory of 21 September 2021 says civil penalties apply on a strict liability basis; that insurers, incident response firms and financial institutions that facilitate payments are exposed; and that licence applications face a presumption of denial. Prompt reporting to law enforcement or CISA and full cooperation are significant mitigating factors.

The US government strongly discourages payments, warning that they fund criminals, encourage further attacks and do not guarantee data recovery.

Bans and reporting

The UK is developing a payment ban for the public sector and critical national infrastructure, a pre-payment notification regime for others and mandatory incident reporting; 72% of consultation respondents backed the ban, but no law had passed by February 2026 (Goodwin). In the US, CIRCIA will require covered critical-infrastructure entities to report ransom payments within 24 hours; the final rule went to White House review on 1 October 2026 (Paubox).

Insurance

Cyber policies may cover extortion, but only if declared controls are real. A September 2026 alert in the National Law Review cites a 2022 US case where a policy was rescinded because MFA existed only on the firewall, not enterprise-wide as declared.

Decision checklist

Do you have clean, offline, tested backups?
Paying rarely stops leaks of stolen data.
Screen the group and wallets for sanctions exposure.
Notify your insurer before negotiating.
Report early to authorities.
Make it a documented board-level decision with legal advice.

Prevention

Keep immutable backups and rehearse restoration.
Protect remote access with phishing-resistant MFA.
Agree in advance who decides on payment, and on what criteria.
Keep insurer, counsel, forensics and law-enforcement contacts ready.