Data recovery lab, London · Mon–Sat 09:00–18:00 020 7064 4996 info@dataretrieval.org.uk

The UK’s planned ransomware payment ban: what it means and how to recover without paying

October 28, 2026

The UK government plans to stop public bodies paying ransoms to cyber criminals, and to make every other organisation tell it before paying one. Here is where the plans stand, why they matter even for small businesses, and how recovery works when paying isn’t an option.

What the government has decided

On 22 July 2025 the Home Office published its response to a consultation on ransomware. It confirmed three measures:

  • A ban on paying ransoms for public sector bodies and operators of critical national infrastructure, such as the NHS, local councils and schools. Nearly three-quarters of people who responded supported it.
  • A duty to notify: organisations not covered by the ban would have to tell the government if they intend to pay. The government could then advise them, and warn them if a payment could break sanctions law.
  • Mandatory reporting of ransomware attacks, which is still being developed. The consultation suggested a first report within 72 hours of an attack and a fuller one within 28 days.

The government has said it will legislate, but it has not yet published a date for the new law. Until then, these are plans rather than rules in force.

Why it matters

The UK’s National Cyber Security Centre (NCSC) dealt with 204 nationally significant cyber incidents in the year to August 2025, up from 89 the year before. That’s about four a week. Ransomware was behind some of the most disruptive attacks, including those on Marks & Spencer and the Co-op.

Even if your business would never be covered by the ban, the direction is clear: paying is becoming harder and riskier. Paying also gives no guarantee that the decryption tool works, or that stolen data is deleted.

Recovery without paying

Many organisations get their data back without paying the attackers. Ransomware often misses some files, and backups, snapshots, shadow copies and unencrypted areas of a disk can all be starting points. What you do in the first hour decides how much can be saved:

  • Disconnect affected machines from the network, but don’t wipe or reinstall anything.
  • Keep the ransom note, encrypted files and logs. They help identify the ransomware and what can be recovered.
  • Don’t run a RAID rebuild or restore over the top of the affected disks until a copy has been made.
  • Report it to Report Fraud, the national fraud and cyber crime service that replaced Action Fraud, at reportfraud.police.uk.

We work from a sector-by-sector copy of every disk, so your original drives are never written to. Call the lab on 020 7064 4996 and we’ll tell you straight away what to switch off and what not to touch.

Sources