Should we pay a ransom if the attackers say they copied our data?

Paying does not undo the theft. You would be paying criminals for a promise to delete data they have every reason to keep, and law-enforcement agencies, Europol and national police forces among them, advise against paying; there are reported cases of data being published or sold after payment. Paying a sanctioned person or group can also be illegal. The decision belongs to management, with your incident-response provider, insurer and lawyers. Before deciding, establish the facts: what really left, whether it contains personal data, which notifications are due regardless of payment, and what you will tell the people affected. Under the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679)., a personal data breach is assessed on what happened, not on whether a ransom was paid. NetSenX does not negotiate; it helps with the facts, through alerts that show which hosts sent unusual volumes out and when.

← All 60 questions on Incident responseAll topics