# Should we pay a ransom if the attackers say they copied our data?

Paying does not undo the theft. You would be paying criminals for a promise to delete data they have every reason to keep, and law-enforcement agencies, Europol and national police forces among them, advise against paying; there are reported cases of data being published or sold after payment. Paying a sanctioned person or group can also be illegal. The decision belongs to management, with your incident-response provider, insurer and lawyers. Before deciding, establish the facts: what really left, whether it contains personal data, which notifications are due regardless of payment, and what you will tell the people affected. Under the GDPR, a personal data breach is assessed on what happened, not on whether a ransom was paid. NetSenX does not negotiate; it helps with the facts, through alerts that show which hosts sent unusual volumes out and when.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/should-we-pay-if-attackers-say-they-copied-our-data

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What is a ransomware negotiator, and should we use one?](https://netsenx.com/en/faq/what-is-a-ransomware-negotiator)
- [How do we find out what data was stolen?](https://netsenx.com/en/faq/how-do-we-know-what-data-was-stolen)
- [How can we check whether ransomware attackers really stole our data?](https://netsenx.com/en/faq/how-to-check-whether-attackers-really-stole-our-data)
- [Our data is on a leak site. Can we find out when it was stolen?](https://netsenx.com/en/faq/our-data-is-on-a-leak-site-when-was-it-stolen)
- [Does NetSenX record which files were exfiltrated?](https://netsenx.com/en/faq/does-netsenx-record-which-files-were-exfiltrated)