Should a small business pay the ransomware ransom in India?
Key takeaways
- Payment is not a reliable fix: a significant share of victims who pay do not receive a working decryptor, and the attacker commonly keeps access.
- Paying does not end the incident, and rebuilds are still required in most reported cases, so the ransom rarely buys a full return to normal.
- Ransom payments trace to wallets and entities that can attract sanctions and law-enforcement attention, which creates legal risk for the payer.
- The CERT-In obligation to log a cyber incident within 6 hours applies whether or not you pay, and it should not wait for the payment decision.
- Law enforcement in India can assist with decryption and recovery, and a local cybercrime complaint opens routes that a direct payment does not.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
Why is paying usually a bad idea?
Four reasons, in order of how often they decide the case. First, it frequently does not work: a meaningful share of victims who pay never receive a working decryptor, and some receive one that recovers only part of the data. Second, it does not stop the intrusion: the operator usually retains the access they used, and the same actor frequently returns, which is one of the more common patterns in repeat-victim data. Third, it funds the next attack, including the operation that will target you again. And fourth, it creates legal exposure, because the payment path leads to entities and jurisdictions that carry sanctions risk, and a business that has paid may find that its bank, its insurer and its larger customers respond badly.
What are the legitimate reasons to pay?
Two, and both are about preserving the business rather than restoring the data. The first is that the ransom is materially smaller than the value of continuing to trade, and there is no restored backup, no insurance and no prospect of reconstructing the data. The second is that human safety or critical service continuity is at stake, for example a clinic that cannot access patient records or a manufacturer whose line is down. Even then, payment should be a documented decision: a business case, legal advice on sanctions exposure, insurer consent, a CTO-level or owner-level decision recorded with the reasons, and a plan for the rebuild that follows, because the environment is still compromised after payment. If the reasons do not hold up on paper, do not pay.
What should I do instead of paying?
Five things. Report to CERT-In and to law enforcement through cybercrime.gov.in and helpline 1930, because a domestic complaint can open recovery routes, including assistance with decryption, that a direct payment does not. Engage a professional responder to scope what was taken and to check whether a free decryptor exists for the family involved, which does happen and is worth asking about every time. Check every backup, including offline, immutable and cloud versioning copies, and treat any backup that was accessible with the same credentials as suspect. Rebuild rather than restore where the estate is compromised, and harden it during the rebuild. And use the negotiation lever you actually have, which is time: with a brokered operation, an organised, slow, professional response often improves the offer and the outcome.
What does paying do to your legal and commercial position?
It complicates several things at once. Your CERT-In reporting duty is unchanged, and the report should state plainly what happened, including the payment decision and its date. Your insurer will want to see it, and some policies treat payment without consent differently from payment with consent, so get the consent in writing first. Your bank may need to be told, because the payment goes out through an account that will be reviewed. Your customers and larger clients, especially under the DPDP Act 2023 and contractual notification clauses, will ask what you did. And your own staff will know. None of this makes paying impossible, but it means a payment cannot be done quietly, so the decision has to be one you can defend on the record, in public, later.
| Factor | If you pay | If you do not pay |
|---|---|---|
| Data recovery | Decryptor may work, may be partial, may never arrive | Restore from backups or rebuild, slower but under your control |
| Attacker access | Usually retained, so reinfection is common | Remains, so containment and rebuild are mandatory |
| Legal exposure | Payment path can reach sanctioned entities | No payment trail |
| Insurance | May be treated differently without written consent | Claim proceeds on the standard terms |
| Speed to trade | Faster only if a working decryptor arrives | Slower, depends on backup quality |
What are the frequently asked questions?
Get a straight answer on this
Call our 24-hour ransomware line for an independent read on your specific malware family, your decryptor options and your payment risk before you decide.
Send us the details See pricing