To Pay or Not to Pay? The Pragmatic Guide to Ransomware Extortion

The FBI Says Never Pay. Your Board Wants an Answer Tonight.

The official guidance is clean: never pay the ransom. The reality on the ground is messier. When your ERP is frozen, payroll runs Friday, your customer data is being auctioned on a leak site, and your insurer is asking pointed questions about your incident response plan, “never pay” stops being a strategy and starts sounding like a slogan.

This is the moment most executives discover their cybersecurity posture is a fiction — controls were attested to on insurance applications but never enforced, backups exist but were never tested, and the “incident response plan” is a six-page PDF nobody on the call has actually opened. The pragmatic question isn’t whether ransomware is ethically wrong. It’s whether your business survives the next 72 hours.

What Is Double Extortion Ransomware (And Why It Changed Everything)

Traditional ransomware encrypted your data and demanded payment for the decryption key. Solid immutable backups effectively neutralized that threat — restore, wipe, refuse to pay. Adversaries adapted. Double extortion ransomware now exfiltrates your sensitive data before encryption, then threatens to publish it on a dark-web leak site if payment isn’t made. Several groups have escalated to triple extortion: DDoS attacks against your public services, or direct harassment of your customers and employees.

• Exfiltration first: Attackers dwell in the network an average of 9 days before deploying ransomware, quietly stealing terabytes.
• Leak-site auctions: Stolen data is posted in stages — sample, then 25%, then full dump — to ratchet pressure.
• Regulatory fallout: HIPAA, state breach notification, GDPR, and SEC disclosure rules trigger regardless of whether you pay.
• Insurance complications: Modern policies require pre-payment carrier approval and OFAC sanctions screening of the threat actor.

What you’re really weighing when you decide whether to pay the ransom:

• ⚠ Operational downtime (typical mid-market: $250K–$1M per day)
• ⚠ Customer notification, credit monitoring, and regulatory fines
• ⚠ Class-action and shareholder litigation if exfiltrated data surfaces post-payment
• ⚠ OFAC sanctions violations if the threat actor is on a U.S. Treasury list
• ⚠ Re-extortion risk — payment marks you as a willing target
• ⚠ Coverage gaps if your insurer pre-authorization process wasn’t followed

The Decision Framework: When (and Whether) to Pay the Ransom

There is no universal answer. There is a framework. Walk every ransomware negotiation through these four questions before your CEO signs a wire transfer.

The Three Pillars of a Pragmatic Ransomware Response

If you want the option to refuse to pay the ransom — or to negotiate from a position of strength rather than panic — three operational pillars have to be in place before the first encrypted file appears. CMIT Solutions builds and operates all three for mid-market and enterprise clients.

Cyber Insurance Requirements: What Your Policy Probably Won’t Cover

Cyber insurance has hardened dramatically. Premiums are up, sublimits are down, and exclusions have multiplied. If you’re quietly counting on your policy to write the ransom check, read it again. Standard cyber insurance requirements in current renewals include:

• MFA on all privileged accounts, remote access, and email
• EDR / XDR deployed on every server and workstation — not just AV
• Immutable backup architecture with documented restore testing
• Written incident response plan with annual tabletop exercises
• Security awareness training with phishing simulation metrics
• Patch management SLAs for critical and high CVEs
• Privileged access management (PAM) for domain admin and cloud root accounts

Miss any one of those — even if you attested to it on the application — and your carrier has grounds to deny the claim. The carrier’s post-loss audit is more thorough than the underwriting audit. By the time they’re writing checks for a seven-figure event, they’re looking for reasons not to.

The Canvas LMS Case: Why “Successful” Payments Aren’t the Rule

A widely circulated incident involving a Canvas LMS breach reportedly saw the threat actor return exfiltrated data after a ransom was paid. On the surface, this looks like vindication for the pay-to-recover strategy. It isn’t — and treating it as a template is dangerous.

Threat intelligence across Coveware, Sophos, and FBI IC3 reporting shows that fewer than half of victims who pay recover all of their data, and a substantial percentage are re-extorted within 12 months — sometimes by the same group, sometimes by an affiliate, sometimes by a downstream buyer of the stolen credentials. Paying establishes you as a viable target inside private threat-actor channels. The Canvas outcome is the exception negotiators cite to justify the strategy. The rule is that the data was already copied, sold, or staged for future leverage before the “deletion” was demonstrated.

Defend with CMIT Solutions

The right time to decide whether you’d pay the ransom is six months before an attack — not at 2 a.m. on a Saturday with your CFO, outside counsel, and a forensics firm you’ve never worked with on the bridge call. CMIT Solutions builds the operational foundation that makes the decision defensible either way: immutable BDR so encryption isn’t existential, a 24/7 Incident Response retainer so the first hour is professional rather than panicked, and Cybersecurity Assessment that aligns your controls with your cyber insurance requirements. When the ransom note arrives, your decision becomes a calculation — not a crisis.