Ransomware Industry Divided Over Whether Victims Should Pay Criminals Before or After Cybersecurity Consultants Invoice Them
Hackers, insurers, executives and Whitehall officials unite behind Britain’s proudest tradition: blaming whoever clicked the email
LONDON — By Ingrid Falk. A dramatic rise in ransomware attacks has reopened the national debate over whether British businesses should pay hackers, refuse point-blank, or simply hand the whole enterprise over to criminals and ask them ever so politely to improve quarterly performance. According to the Financial Times report on the ransomware payment debate, confirmed victims rose 389 per cent in 2025, from roughly 1,600 to 7,831 worldwide. Meanwhile, the National Cyber Security Centre’s ransomware guidance, the Information Commissioner’s Office guidance on ransomware compliance, and Action Fraud’s cyber crime reporting service all recommend preparation, prompt reporting and robust security — three activities traditionally postponed until six minutes after every screen in the building displays a skull wearing sunglasses and the office Wi-Fi starts charging a ransom of its own.
The ransomware trade now runs like a proper British institution: everyone queuing patiently to blame someone else.
Hackers break in. Executives announce the incident is “limited in scope.” Press officers explain that “limited” covers every customer since the Blair government. Insurers hunt the policy for a clause excluding electricity, computers, criminals or bank holidays. The NCSC recommends not paying. Cybersecurity consultants recommend a twelve-month “resilience transformation programme” costing roughly three ransoms and one away-day in the Cotswolds.
Everyone agrees the system is a disgrace. Everyone has also found a remarkably comfortable way to make money from the disgrace.
Hackers Complain British Institutions No Longer Take Cybercrime Seriously Enough
Ransomware gangs this week expressed genuine frustration that historic British institutions remain so poorly defended, despite years of internal seminars titled Building Tomorrow’s Secure Digital Future Today, delivered by a man called Kevin who once did a course.
The gold standard here remains the Rhysida ransomware group’s attack on the British Library in October 2023, in which attackers exfiltrated hundreds of gigabytes of data, demanded 20 bitcoin, and left the nation’s principal research library reduced to a card catalogue and a strongly worded statement. The Library declined to pay. The data went up on the dark web anyway, which is roughly the digital equivalent of a burglar posting your diary through every letterbox on the street because you wouldn’t give him bus fare.
“We got in through a third-party account with no multi-factor authentication,” said a hacker identifying himself only as Nigel_Not_A_Real_Hacker. “Frankly we assumed the British Library, of all places, would have read the manual on how to lock a door.”
Cybercriminals insist they are not extortionists but “unauthorised digital transformation partners.” Traditional consultants ask an institution what its systems do, hold eighteen workshops, and submit a PowerPoint. Hackers discover what the systems do in forty minutes, switch them off, and leave a ransom note in PDF format, because even criminals believe in a nicely formatted document.
One ransomware negotiator noted that criminals now offer better customer service than most British broadband providers.
“The hacker answers within five minutes,” he said. “Try getting a callback from your internet provider without first navigating four menus and a hold-music rendition of Vivaldi.”
Executives Discover Cybersecurity Immediately After Losing It
Company boards responded to the crisis by demanding stronger protection, clearer accountability, and firm assurances that neither would touch the bonus pool.
Before an attack, cybersecurity is “a cost centre.” After an attack, it becomes “our highest strategic priority,” announced from a lectern with the corporate crest freshly polished. Three weeks later, once the chief executive has done one solemn interview on the local news wearing an open-collared shirt, cybersecurity quietly returns to being a cost centre, filed somewhere near the office plants.
A survey by the Institute for Things Everyone Already Knew found that 94 per cent of British executives believe cyber resilience is essential, while 91 per cent would rather spend the budget on reception furniture and a “wellbeing pod.”
“We take the protection of customer data extremely seriously,” said one chief executive whose firm had stored 12 million records in a folder marked “Miscellaneous — Do Not Delete (Probably).” The company later clarified it had taken the data seriously enough to collect it, sell access to it, duplicate it across seven vendors, and retain it decades past any conceivable use. It had not, however, taken it seriously enough to actually protect it.
Senior management blamed a “sophisticated threat actor” — the boardroom phrase for someone who correctly guessed the finance director’s password was the name of his spaniel followed by the number 1.
Staff Asked to Spot Phishing Emails Written by People With Unlimited Time and No Shame
Employees have been drafted into the cyberwar via annual training videos featuring actors who have evidently never received an email from a real British workplace in their lives.
Staff are told to check spelling, suspicious links and unusual requests. This proves tricky when ordinary internal emails already contain all three, sent from HR, at 4.58pm on a Friday, marked URGENT in capitals for reasons nobody has ever explained.
A genuine company email might read: “URGENT: Kindly validate your payroll credentials via the new portal before 4pm or salary processing may fail.” A criminal one might read exactly the same, minus the seven-strong CC list and the passive-aggressive follow-up chaser.
IT tells staff never to click unfamiliar links while the organisation itself sends a dozen unfamiliar links each morning across five different HR platforms nobody remembers signing up for. Workers are also warned against opening unexpected attachments, despite entire departments running on a file called “FINAL_v7_REVISED_USE_THIS_ONE_2.xlsx.”
One eyewitness described the moment a colleague clicked a malicious attachment. “He asked if it was safe,” she said. “IT told him to raise a ticket. The ticketing system was already encrypted.”
Whitehall Insists Criminals Must Never Be Rewarded, Unless the NHS Rather Needs Its Computers Back
The central policy row concerns whether ransom payments should simply be banned outright.
Supporters argue payments fund criminal enterprise and invite further attacks. This is logically sound. Feed the pigeons in Trafalgar Square and you get more pigeons. Feed ransomware gangs and you get pigeons with a Bitcoin wallet and a press office.
Critics note that banning payments outright can leave hospitals, councils and utilities unable to recover critical systems, which is also logically sound, particularly when the encrypted machine is scheduling chemotherapy rather than the office five-a-side league.
The Government is moving toward barring public-sector bodies and critical infrastructure operators from paying ransoms altogether, while critics warn a blanket ban could simply redirect attackers toward the private sector instead. Nearly half of targeted British businesses reportedly pay anyway, which tends to happen the moment payroll, production and patient records vanish on the same Tuesday.
Government policy on this currently resembles a parent telling the children never to negotiate with kidnappers, then quietly asking round the back what denomination of notes the kidnappers prefer.
Officials advise maintaining secure backups, segmenting networks, patching software and rehearsing recovery plans. Organisations have welcomed this advice and promise to act on it directly after finishing the digital modernisation programme that began, by some accounts, under a previous monarch.
Cyber Insurers Proudly Cover Everything Except Cyber Incidents
Insurers have entered the debate with the quiet confidence of an industry that knows every national crisis contains a deductible.
Cyber insurance may cover business interruption, legal costs and incident response, although exclusions can leave victims wondering whether the costliest losses will ever actually be reimbursed. US data cited by the Financial Times shows 75 per cent of cyber claims were closed without payment in 2024, while global cyber premiums reached an estimated $15.6 billion in 2025 — a healthy sum for an industry whose core product appears to be a very polite “no.”
One broker explained that clients should read their policy carefully. “Cyber insurance covers cyber events,” he said, “except events involving crime, war, negligence, third-party software, outdated systems, unpatched systems, insider activity, external activity, electricity, or computers.” Asked what remained covered, he offered a complimentary phone consultation and a biscuit.
Cybersecurity Consultants Recommend the Immediate Purchase of More Cybersecurity Consultants
Consultants say the fix is better cyber hygiene, identity controls, network visibility, tested backups and continuous monitoring. They are entirely correct. They are also available to explain all of it via a 148-page report featuring three overlapping circles labelled “People,” “Process” and “Technology,” billed at a day rate that would make a QC blush.
A consultant’s chief skill is translating “update your software” into “establish a forward-looking, patch-governance ecosystem aligned with enterprise risk appetite.” The invoice, naturally, arrives encrypted for security.
Software Vendors Assure Customers the Vulnerability Is Fixed in the Premium Tier
Technology vendors remind customers that security is “a shared responsibility.” The vendor is responsible for selling the software. The customer is responsible for discovering what’s wrong with it, usually at 2am, usually alone.
A typical British company depends on hundreds of external providers, cloud platforms and contractors, each promising “military-grade security” — a reassuring phrase, given that military computer projects are famously delivered early, under budget, and without anyone emailing classified documents to their personal account.
When a breach occurs, the vendor blames the customer’s configuration. The customer blames the vendor. The contractor blames a subcontractor. The subcontractor has since dissolved and reopened under a different name in Reading.
Customers Receive Two Years of Credit Monitoring and a Lifetime of Suspicion
Ordinary customers remain the unpaid supporting cast of the ransomware economy. Their names, addresses, medical records, passwords and financial details may be stolen, and they are comforted with two years of free identity monitoring — the digital equivalent of losing your front door and being handed a complimentary telescope.
“We regret any inconvenience,” the breach notification begins. “Inconvenience” is a wonderfully flexible word, doing service for delayed trains, missing luggage, and the possibility that a teenager overseas now holds enough personal information to apply for your mortgage.
Britain Perfects the Ideal Business Model: Crime as a Subscription Service
Ransomware thrives because every party behaves entirely rationally within a collectively absurd system. Hackers attack because it pays. Companies pay because downtime costs more. Insurers insure because fear sells policies. Consultants advise because confusion sells consultancy. Whitehall discourages payment because crime shouldn’t pay, while stopping short of an outright ban because, occasionally, crime holds the only working decryption key. Customers get an apology, because an apology remains cheaper than proper infrastructure.
The result is ransomware-as-a-service, cybersecurity-as-a-service, insurance-as-a-service, and public concern as a permanently renewable national resource.
The most effective defence remains stubbornly boring: maintained backups, restricted access, multi-factor authentication, network segmentation, timely patching, rehearsed recovery plans and staff who feel able to report a mistake without being marched to HR. These measures lack the glamour of artificial intelligence, blockchain or a chief cyber visionary in trainers with a suit, which is precisely why so many institutions — including, memorably, one of the nation’s oldest libraries — neglect them until it’s too late.
Britain has connected every hospital, bank, council office and industrial fridge to the internet, then secured the whole lot with passwords chosen by people who get quite cross when told to include a capital letter.
The criminals may be immoral. They are not, in the slightest, confused about the business model.
This report concerns genuine ransomware risks, real policy disputes, and authentic institutional incompetence, lightly marinated in exaggeration. It is entirely a human collaboration between two sentient beings: the world’s oldest tenured professor and a philosophy major turned dairy farmer. No computer systems were encrypted during production, although one printer remains under investigation.
For the American accent on the same racket, our cousins file from Bohiney.com.
Auf Wiedersehen, amigo!
Harriet Collins is a high-output satirical journalist with a confident editorial voice. Her work demonstrates strong command of tone, pacing, and social commentary, shaped by London’s media and comedy influences.
Authority is built through volume and reader engagement, while expertise lies in blending research with humour. Trustworthiness is supported by clear labelling and responsible satire.
