← All Blogs

Recovering from ransomware without paying, step by step

By Best IT MSP Editorial Team - Updated October 21, 2026 - 14 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

Can you recover from ransomware without paying?

Yes, and most victims now do. Chainalysis put the share of victims who paid at 28 percent in 2025, potentially an all-time low, and Sophos found 66 percent of organizations whose data was encrypted recovered it from backups. Paying is now the minority choice. This article is preparation reading. It sets out what published government guidance says. It is neither legal advice nor a script for a live incident.

The decision goes wrong because of when it gets made. Ransomware is common. Verizon found ransomware in 48 percent of all breaches, up from 44 percent the year before, and IBM reported that 39 percent of breached organizations had systems hit by ransomware. Sophos measured 56 percent of attacks succeeding in encrypting data, up from 50 percent, and found only 1 in 3 smaller organizations stopped the attack before encryption. So the moment arrives for a lot of ordinary businesses, usually at night, with a frightened team and somebody arguing that a wire transfer beats a restore.

Five things decide whether the no-pay path is open. An offline backup the attacker could not reach, somebody who has restored from it, the published checklist, a free decryption tool if one exists, and an early call to law enforcement.

What US government guidance actually says about paying

The published federal position is discouragement, not prohibition. The joint FBI and CISA ransomware advisories state that the authoring organizations do not encourage paying ransom as payment does not guarantee victim files will be recovered. The same paragraph adds that payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and fund illicit activities.

The next sentence carries the caveat most summaries drop. The advisory continues, regardless of whether you or your organization have decided to pay the ransom, and then asks you to report the incident promptly either way. The guidance assumes some victims will pay. It does not forbid it.

Treasury uses firmer words. Its 2021 counter-ransomware action states that the US government continues to strongly discourage the payment of cyber ransom or extortion demands. Nothing in these documents makes a payment by a private company unlawful on its own. One case does, covered below.

The main document is the #StopRansomware Guide, published jointly by CISA, the FBI, the NSA and the MS-ISAC. It comes in two parts. Part 1 covers preparation and prevention. Part 2 is the ransomware and data extortion response checklist, the part to read before an incident.

A ransom buys a decryption key. It does not buy a tested restore, a clean rebuild or a quiet quarter.

The sequence the published checklist actually follows

The checklist puts containment first, evidence second and restoration third, and the payment question nowhere near the top. Its opening instruction reads determine which systems were impacted, and immediately isolate them. Where several systems or subnets look affected, it says to take the network offline at the switch level, and it treats powering machines down as a fallback to be used only if it is not possible to temporarily shut down the network.

Two steps in the middle are the ones buyers skip, and both protect the no-pay path. The first is evidence. The guide asks you to take a system image and memory capture of a sample of affected devices and to preserve evidence that is highly volatile in nature, because a wipe-and-rebuild destroys the only record of how they got in. The second is the decryption tool question below.

The published order, in plain words, runs as follows.

• Isolate the affected systems first, and the network at the switch if it has spread.
• Preserve a system image and memory capture from a sample of machines before anyone rebuilds.
• Triage impacted systems for restoration and recovery.
• Ask federal law enforcement about an available decryption tool before you commit to a rebuild.
• Rebuild using pre-configured standard images where you have them.
• Reset passwords for all affected systems as part of eradication.
• Restore data from offline, encrypted backups, taking care not to re-infect clean systems.

Our post on the first 24 hours after a breach covers the hour-by-hour version. This section is only about where the payment decision sits. It sits late, after triage, and after you know whether a free tool exists.

Free decryption tools exist for some ransomware families

To find out whether a free decryption tool exists for your case, check No More Ransom before you rebuild. The project is an initiative by the National High Tech Crime Unit of the Netherlands' police, Europol's European Cybercrime Centre, Kaspersky and McAfee, and it publishes free tools covering more than 150 named ransomware families, among them Akira, Babuk, Darkside, Hive, LockBit 3.0, Phobos, REvil and Rhysida.

How a victim uses the Crypto Sheriff

The matching service is called Crypto Sheriff and it takes three inputs. You upload encrypted files no larger than 1 MB each, two of them. You type in any email, website URL, onion or bitcoin address you see in the ransom demand. You can also upload the ransom note itself as a .txt or .html file. If a tool matches, the project says we will provide you with the link to download the decryption solution.

One instruction on the tools page matters more than the rest. Make sure you remove the malware from your system first, otherwise it will repeatedly lock your system or encrypt files. A decryption tool cannot clean the machine, and you only get one clean attempt to decrypt.

The project is blunter about payment than any government page. The general advice is not to pay the ransom, it says, and it tells victims there is no guarantee you'll get the decryption key you need in return.

Ask law enforcement as well, because the public list is not the only list. The joint guide tells victims to consult federal law enforcement, even if mitigation actions are possible, regarding possible decryptors available, on the basis that security researchers may have discovered encryption flaws for some ransomware variants. One phone call can delete the demand.

Where to report ransomware, and whether you have to

Report to one of three agencies and the report gets shared with the others. CISA states that every ransomware incident should be reported to the US government, and a victim can report to the FBI, CISA or the Secret Service, because the agencies share notifications. The published channels are the FBI's Internet Crime Complaint Center at ic3.gov, a local FBI field office, CISA's own incident reporting system, and CISA's 24/7 operations centre on 1-844-Say-CISA.

Incident reporting is voluntary for most firms today

Reporting is voluntary for most US businesses right now, because the mandatory rule exists but has not started. CIRCIA was enacted in March 2022. The statute requires a covered entity to report a covered cyber incident not later than 72 hours after the covered entity reasonably believes that the covered cyber incident has occurred, and to report a ransom payment not later than 24 hours after the ransom payment has been made. CISA's own page says that organizations are not required to submit covered cyber incident or ransom payment reports under CIRCIA until the final rule's effective date, and that it strongly encourages organizations to continue voluntarily sharing cyber event information. So the clocks are written, and the starting gun has not fired.

One line in the statute is worth knowing before you ever authorise a payment. The 24-hour payment report shall apply even if the ransomware attack is not a covered cyber incident. Once the rule is in force, the act of paying is itself a reportable event for covered entities, on a tighter clock than the attack.

Other duties already bite regardless. A firm covered by the FTC Safeguards Rule must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event where a notification event involves the information of at least 500 consumers.

Reporting correlates with a cheaper recovery

Calling law enforcement is also the cheapest line item in the whole response. IBM's 2024 Cost of a Data Breach study found that law enforcement involvement in a ransomware attack lowered the cost by an average of $1 million, excluding the cost of any ransom paid, and cut the time to identify and contain a breach from 297 days to 281. The same study found only 52 percent of ransomware victims involved law enforcement, and that 63 percent of those did not end up paying the ransom. Read those as a direction, not as your own number, because IBM studies large organizations.

Sometimes the call comes the other way. CISA reported 3,368 pre-ransomware notifications since the initiative began, with 2,131 of them conducted in 2024 as of November, warnings of early-stage ransomware activity so organizations can prevent encryption. Nobody can register for that. What makes you reachable is an accurate contact in your domain records.

Why paying is not the shortcut it looks like

Paying buys a decryption key, not a recovery, and four published findings show the gap.

It does not remove the restore work

Paying and restoring are not alternatives for most victims. Sophos found 48 percent of encrypted victims paid the ransom and separately found that backup-based recovery reached 66 percent of encrypted-data cases, up 12 percentage points. Both shares are measured across the same group. They add to 114 percent, so at least 14 percent of victims paid the ransom and still restored from their own backups. Paying moved the deadline. It did not move the work. The average recovery cost of $1.7 million per incident, up 11 percent year over year, excludes the ransom entirely.

It does not reliably come in under the demand

Negotiation is normal and the totals stay large. Sophos recorded a median ransom demand of $698,000 and a median ransom payment of $769,000, with 51 percent of paying organizations negotiating a lower amount than the demand, and the median payment down from $1 million a year earlier. Treat a discount as a possibility rather than a plan.

It does not buy deletion of stolen data

Paying to suppress stolen data is the weakest version of the trade, and the people who negotiate these cases say so plainly. Coveware reports that victims increasingly treat a payment to suppress the proliferation of stolen data as having de minimis to zero utility, that data exfiltration-only ransom payments fell to 19 percent in Q3 2025, and that its overall payment rate fell to a historical low of 23 percent in the same quarter. It now describes starting from a position of non-payment as the base scenario as codified best practice. Coveware sells incident response, so weigh that as a practitioner's view backed by its own caseload. Double extortion, where the attacker also took a copy, is the same trade.

It can be a sanctions problem

A payment becomes unlawful when the money reaches a designated person, and that is the sanctions risk nobody raises at 2am. The US Treasury designated Dmitry Khoroshev, a leader of LockBit, a group alleged to have received more than $500 million in ransom payments, and notes that OFAC's regulations generally prohibit all dealings by US persons or within the United States in a designated person's blocked property. Treasury has designated the plumbing as well as the people, including SUEX, the first virtual currency exchange to be designated, for facilitating transactions involving proceeds from at least eight ransomware variants.

The exposure is not only yours, which is why the decision stops being yours alone. Treasury strongly encourages victims and related companies to report these incidents to and fully cooperate with law enforcement as soon as possible, and says that doing so can earn significant mitigation related to OFAC enforcement matters and voluntary self-disclosure credit in the event a sanctions nexus is later determined. Your cyber insurance carrier, your negotiator and your bank carry the same question. Ask your own lawyer before an incident, not during one.

What recovery really costs, and how long it takes

No published ransomware recovery figure is scoped to a 20-person office, so read every number here with its sample attached. Sophos surveyed 2,158 IT and cybersecurity leaders in 17 countries at organizations of 100 to 5,000 employees, with answers gathered between January and March 2026. Its average recovery cost of $1.7 million is therefore a mid-market number, not a small-business number, and it still excludes the ransom. Anyone quoting it as the cost of your incident has the wrong sample.

Two medians an order of magnitude apart tell you more than either one alone. Sophos puts the median ransom payment at $769,000 among organizations of 100 to 5,000 staff. Chainalysis, counting payments on the blockchain across all victims, puts the 2025 median payment at $59,556, up 368 percent from $12,738 in 2024, against $820 million in total on-chain payments, down 8 percent from $892 million even as claimed victims rose about 50 percent year over year. The gap between those two medians is sample, not disagreement. A smaller firm's demand is far likelier to resemble the Chainalysis figure, and Coveware's caseload sits in between, with an average payment of $376,941 and a median of $140,000 in Q3 2025.

On duration, plan around the long tail rather than the headline. Sophos found 14 percent of victims across sectors needed one to three months to fully recover, and 26 percent in education, nearly double that cross-sector average. IBM's 2026 report gives an average of 247 days to identify and contain an active breach across all industries and a global average breach cost of $4.99 million, but that measures the whole breach lifecycle at large organizations, not the days your servers are dark.

The restore-time arithmetic for your own systems is a separate question, and a better one for your managed service provider. We work it through in how long a full restore really takes.

What decides whether the no-pay path exists at all

Two things decide it, and both are settled months before the incident. The first is a backup copy the attacker could not reach, which means an immutable or genuinely offline copy outside the identity domain they just took over. The second is a restore somebody has already performed and timed. CISA's performance goals ask you to securely store backups offsite and offline, and to test backups and recovery on a recurring basis, no less than once per year. That is a published floor from an agency with nothing to sell you.

The series already covers the architecture. Immutable backup explained sets out what a retention lock does and where it fails, and when was your backup last restored covers what counts as evidence of a real restore test.

The plan is the second dependency, and the cheap one. CPG 1.C asks that incident response plans be reviewed and drilled, at a minimum, on an annual basis, and CPG 5.B asks for procedures on to whom and how to report confirmed incidents, reporting to CISA as soon as safely feasible. A drill is where you decide the payment question cheaply, around a table. Our fire drill for testing your provider's incident response is one way to run it.

Three decisions belong in writing now, while nothing is on fire.

• Name the person who decides on a ransom payment, and the people who must be on the call first.
• Record the date and duration of the last tested restore, and refresh that record at least once a year.
• Agree who files the IC3 report and who contacts CISA, with the 1-844-729-2472 number written into the incident response plan.

Seven questions to ask your provider before you need the answers

Send these seven to whoever manages your IT and keep the answers with the plan. A provider operating the controls answers with dates and names. A weak one names products.

• Which of our backup copies could a compromised domain administrator not delete, and when was it last restored?
• Who on your team has filed an IC3 report before, and will you file ours or do we?
• What is your process for checking No More Ransom and asking law enforcement about a decryption tool?
• Does our incident response retainer include a sanctions check before any payment is discussed?
• How do you preserve a system image and memory capture before rebuilding an infected machine?
• What did our last drill conclude about paying, and who signed that conclusion off?
• Which systems would we rebuild from a standard image, and which have no image at all?

None of this makes a payment unthinkable, and none of it makes recovery certain. It makes the decision a prepared one instead of a panicked one. The guidance discourages paying, the data says most victims no longer do, and the preparation behind that is ordinary and boring. Take the legal question to a lawyer, because this article describes published guidance and is not legal advice.

FAQ

Can you recover from ransomware without paying the ransom?

Yes, and most victims now do. Chainalysis put the 2025 payment rate at 28 percent, potentially an all-time low, and Sophos found 66 percent of encrypted organizations recovered from backups. Recovery depends on an offline backup the attacker could not reach and a restore your team has already practised.

Is it illegal to pay a ransomware demand in the US?

Not in itself for most private firms. Joint FBI and CISA advisories say they do not encourage paying ransom as payment does not guarantee victim files will be recovered, which is discouragement rather than prohibition. A payment reaching a sanctioned person is different, because OFAC's regulations generally prohibit all dealings by US persons in blocked property. Ask a lawyer, not a vendor.

Do you have to report a ransomware attack to the government?

Reporting is voluntary for most US businesses today. CIRCIA's 72-hour incident clock and 24-hour ransom payment clock do not apply until the final rule takes effect, and CISA states that organizations are not required to submit CIRCIA reports before then. Sector rules still apply, and CISA asks that every ransomware incident be reported.

Where do I find a free ransomware decryption tool?

Start at No More Ransom, run by the Dutch police, Europol, Kaspersky and McAfee, which publishes free tools for more than 150 ransomware families. Upload two encrypted files no larger than 1 MB each plus the ransom note to its Crypto Sheriff. Remove the malware first, or it will repeatedly lock your system or encrypt files.

Does paying the ransom get your data back faster?

Not reliably. Sophos found 48 percent of encrypted victims paid and 66 percent restored from backups, so many did both, and the average recovery cost of $1.7 million excludes the ransom. Coveware reports that paying to suppress the proliferation of stolen data has de minimis to zero utility. Plan for a restore either way.

← All Blogs