1. Introduction
In July 2025, the UK Government, in partnership with the National Cyber Security Centre (NCSC), unveiled new legislation targeting ransomware payments. Under the proposals:
- All public sector bodies including NHS trusts, local authorities, schools and operators of critical national infrastructure (CNI) will be banned from paying ransom demands.
- Private sector organisations not covered by the ban must notify the government before making any payment.
This marks a significant shift in strategy from discouragement to prohibition in certain cases and has sparked extensive debate over effectiveness, feasibility, and unintended consequences. In this article we explore how the ban came about, how it operates, its intended goals, stakeholder reactions, and what it means for organisations preparing for the future.
2. Background: The ransomware threat in the UK
Ransomware malicious software that encrypts data or exfiltrates information to demand payment has surged in recent years. Its effects extend far beyond financial loss: service disruptions, reputational damage, even risk to life.
High‑profile UK incidents
- In 2023, the British Library suffered a devastating attack that disrupted its technology infrastructure; as a public body it refused to pay the ransom.
- NHS hospitals in London faced an attack earlier this year, which the NHS later identified as a contributing factor in a patient’s death.
- Multiple retail organisations including Marks & Spencer, the Co‑op, and Harrods experienced ransomware incidents in 2025, costing hundreds of millions in lost stock value and customer trust.
Cyber‑security experts estimate ransomware-related damage including payments, downtime, lost business costs the UK economy tens of billions of pounds each year IT Pro.
3. The Consultation and Policy Journey
Between mid‑January and early April 2025, the Home Office and NCSC held a public consultation on ransomware policy. It proposed multiple measures:
- A targeted ban on ransomware payments by public sector bodies and CNI operators.
- An economy‑wide ransomware payment prevention regime requiring notification before any payment outside those banned areas.
- A mandatory ransomware incident reporting regime with potential thresholds for size or turnover.
Consultation responses numbered under 300, but showed strong support: approximately 72 % backed the targeted ban; 47 % supported an economy‑wide payment prevention regime; 63 % were in favour of mandatory incident reporting digitalassetredemption.com.
4. What the New Measures Entail
4.1 Who is banned from paying ransom?
Under the rules confirmed on 22 July 2025, public sector bodies and operators of critical national infrastructure such as NHS trusts, local councils, and schools are prohibited from paying any ransom demands. This mirrors a de facto practice but now carries legal weight.
4.2 What private sector organisations must do
Private companies not covered by the ban are required to notify the government before paying a ransom demand. This enables authorities to:
- Provide advice and support.
- Warn if the payment would breach sanctions laws (many cyber‑criminal groups are sanctioned, particularly those based in Russia).
- Gather valuable intelligence on current threats.
The government is also developing mandatory incident reporting, which if enacted would require reporting of ransomware incidents (not just payments) within a defined timeframe, potentially 72 hours, to support law enforcement and intelligence gathering.
4.3 Enforcement and penalties
Officials are yet to detail the precise enforcement model. Consultation respondents raised concerns about overly punitive penalties, especially criminal sanctions, emphasising the need for sensible thresholds, clarity on supply‑chain inclusion, and appropriate guidance for organisations Industrial Cyber.
5. Goals and Government Rationale
The new measures aim to disrupt the criminal business model that fuels ransomware. Security Minister Dan Jarvis stated:
“Ransomware is a predatory crime that puts the public at risk, wrecks livelihoods and threatens the services we depend on… we are sending a clear signal that the UK is united in the fight against ransomware.”
By removing the possibility of ransom payment in high‑value sectors, the measures dethrone the profit motive and ideally make the UK a less attractive target. Mandatory reporting helps authorities track threat actors more effectively and coordinate responses SecurityWeek.
6. Stakeholder Reactions
6.1 Wide support in principle
Surveys suggest corporate enthusiasm in the abstract is high: Commvault’s 2025 research found 94 % of public sector leaders and 99 % of private sector leaders supported a ban but emphasised that many admitted they would still pay if their company’s survival was at stake PR Newswire.
6.2 Expert praise and scepticism
Cybersecurity professionals and legal analysts are divided:
- Advocates argue the ban is a bold and necessary step, levering legal prohibition to change attacker calculus PR Newswire.
- Critics warn of unintended consequences: businesses may become reluctant to report incidents, take non‑compliant action in secret, or outsource payments via foreign entities to circumvent UK law SecurityWeekIT Pro.
Some legal commentators caution the ban risks punishing victims rather than strengthening resilience, especially if guidance is unclear or penalties misapplied IT Pro.
6.3 Concerns around coverage and impact
- Partial scope: The ban covers public sector and CNI, but attackers operate opportunistically. Some argue that without a full economy‑wide ban, cyber criminals will simply switch to other targets.
- Implementation complexity: Questions remain around how the ban applies to supply‑chain entities, external contractors, or UK‑based subsidiaries.
7. Preparing for Compliance
7.1 For public and CNI bodies
Organisations in scope should begin preparations immediately:
- Review and update incident response plans to operate without paying ransoms.
- Ensure offline, off‑site backups exist and are tested regularly.
- Train staff on non‑payment protocols and alternative recovery strategies.
The government emphasises that resilience, not ransom, is the key to recovery. Organisations are encouraged to adopt best practices such as Cyber Essentials, offline backups, and rehearsal of business continuity plans.
7.2 For private organisations
Even if not banned, businesses must:
- Establish an internal notification process for ransom demands.
- Liaise proactively with insurers, legal advisors, and payment intermediaries.
- Engage early with government support channels if considering payment.
- Ensure supplier contracts and supply‑chains are understood and compliant—especially if those partners are public‑sector or CNI participants.
7.3 Incident reporting obligations
Organisations should be ready to submit ransomware incident reports, possibly within a 72‑hour window depending on final legislation. Prepare internal structures for rapid capture of essential incident data and assessment of thresholds for mandatory reporting.
8. Broader Implications
8.1 Undermining criminal incentives
By legally barring ransom payments among major public players, the model of Ransomware‑as‑a‑Service (RaaS) could become less profitable. If enough high‑value organisations are off the table, attackers may shift tactic or be forced into larger, lower‑margin targets.
8.2 Intelligence benefits
Mandatory notification/reporting equips law enforcement and NCSC with insight into active campaigns, TTPs (tactics, techniques, procedures), and funding flows making disruption more likely.
8.3 Risk of unintended behaviour
Criminal behaviours may adapt victims might attempt secret payments, shift to payments via foreign jurisdictions, or not report incidents at all, undermining transparency and increasing regulatory challenge for enforcement.
9. Prospects and Open Questions
9.1 Timeline and rollout
As of 22 July 2025 the proposals are confirmed; however, key aspects scope of supply‑chain coverage, enforcement thresholds, civil vs criminal penalties, reporting windows are still under refinement. Final guidance is expected to be published ahead of implementation, though firm dates remain unannounced.
9.2 Sectoral variation
Public bodies and CNIs may garner earlier or stricter enforcement; private organisations may face softer penalties conditional on compliance with notification regimes.
9.3 Need for supporting investment
Critics emphasise that legislation alone is insufficient. Without investment in resilience, backups, recovery testing, training, organisations may still be forced to consider unlawful ransom options or suffer unacceptable disruption.
10. Conclusion
The UK’s ransomware payment ban represents a bold policy experiment: turning a long-standing discouragement into legal prohibition for key public and infrastructure sectors, coupled with a notification and reporting regime for private organisations. Its ambition is to weaken ransomware business models and empower law enforcement differences from past years where ransomware played into the hands of criminals.
However, success is far from guaranteed. Without well‑defined implementation, proportionate enforcement, and robust guidance, the measures could simply drive vulnerability underground or exacerbate challenges for victims. If, however, they are supported with proactive compliance, resilience investment, and cross-sector collaboration, they may help shift the balance back towards preparedness and away from the coercive grip of cyber‑extortion.
This is a pivotal moment in UK cybersecurity policy. Organisations across sectors would be wise to prepare now before the statutory regime arrives.