Ransom payment ban
A legal prohibition on certain organizations paying a cyber ransom, adopted by several US states and under way in the United Kingdom for the public sector, which removes the payment option from claims handling.
A ransom payment ban is a measure by which a legislature forbids certain categories of organizations, most often public bodies and critical infrastructure operators, from paying a ransom after a ransomware attack. It differs from the prohibition arising from sanctions, which only targets payments to designated persons: here it is the payment itself that is proscribed, whoever the recipient. The reasoning is economic. If the most visible targets cannot pay, the attackers' business model loses its return on them, and they cease to be priorities. The objections are well known: an organization deprived of the payment option may suffer a longer outage, and a ban may encourage concealed payments. For insurance, the measure removes an option from claims handling, shifts cost toward restoration and business interruption, and adds weight to backup requirements at underwriting. It is part of the broader movement by which the state takes back control over a risk the market treated as a private matter.
North Carolina and Florida in 2022 prohibited their state agencies and local governments from paying a ransom. In the United Kingdom, the government put out to consultation in January 2025 a ban covering the public sector and operators of critical national infrastructure, then announced in July 2025 its intention to implement it.
- UK Home Office, response to the ransomware consultation, July 2025
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.