Should You Pay a Ransomware Ransom? What the Law and Experience Say

It's the question nobody wants to have to answer under pressure, and yet it's exactly the situation most businesses face it in: systems encrypted, operations halted, a 48- or 72-hour window before the price goes up or the data leaks, and a board waiting for a clear recommendation. There's no universally correct answer. What there is, is a set of factors that should weigh more heavily than the panic of the moment.

There's no explicit, general prohibition on paying a ransomware ransom in Colombia, unlike some jurisdictions that do restrict payments to internationally sanctioned actors. That said, this doesn't mean paying is neutral territory. If the payment ends up in the hands of an internationally sanctioned organization — something the victim business can rarely verify with certainty at the moment of deciding — additional legal complications can arise, especially if the company has operations or business relationships in jurisdictions that do sanction that kind of transfer.

Regardless of whether payment happens, the incident remains subject to the obligations that already exist under the Cybercrime Law (Law 1273) — the attack itself is a crime, whether or not the victim decides to negotiate — and under Law 1581, if personal data was compromised. Paying the ransom doesn't exempt the business from reporting the incident when required.

The logic of paying sounds simple: hand over the money, receive the key, restore operations. The operational reality is messier.

There's no guarantee of full recovery. Some groups deliver defective or partial decryption keys. Others simply vanish after receiving payment. It's a negotiation with no enforcement mechanism whatsoever.

Paying doesn't eliminate leak risk if double extortion was involved. As we explain in our guide to double extortion, even if the attacker "complies" by not publishing the data, there's no way to verify they didn't keep a copy, and no real guarantee they won't use it later.

Paying can mark a company as a repeat target. There's consistent evidence in the industry that organizations that pay ransoms face a higher likelihood of being attacked again — the payment itself becomes valuable information within the criminal ecosystem.

The decryption process, even when it works, is rarely instant. Restoring full systems using the key an attacker provides can take days, with the added risk of the process introducing data corruption.

None of this means paying is always the wrong call. There are scenarios where the operational pressure is so severe — a hospital, for instance, where lives depend on systems coming back online — that the calculus changes entirely. In those cases, the decision shouldn't be made alone: specialized ransomware negotiators can, in some cases, reduce the amount demanded or more reliably verify the attacker's real ability to deliver on what's promised before any payment is transferred.

Before even weighing the question of payment, the priority is containing the incident and preserving evidence. A 24/7 incident response team can assess in parallel the real scope of the compromise, the viability of restoring from backups, and whether data exfiltration occurred — information that completely changes the decision's calculus.