Public Sector and Critical National Infrastructure (CNI) in the UK are now prohibited from making ransomware payments, as confirmed by the government.
In an effort to combat the growing threat of ransomware attacks, the UK government has announced a ban on ransom payments by public sector and critical national infrastructure organizations. This move aims to protect essential services such as hospitals, schools, and transport from cyber-attacks.
The proposed ban targets any entities not belonging to these protected categories, meaning that companies and organizations outside the public sector or critical national infrastructure that suffer ransomware attacks would be affected. This decision comes in light of numerous UK public sector services, including local councils and hospitals, that have been impacted by ransomware in the past year.
Security Minister Dan Jarvis stated that ransomware is a predatory crime that puts the public at risk and threatens services they depend on. He emphasized that the ban is intended to "smash the cybercriminal business model" and protect essential services.
However, concerns have been raised about the effectiveness of the government's plans. Experts have expressed doubts about the ban's ability to deter attacks and have warned that it may push ransomware attacks further underground. Kev Breen, senior director of cyber threat intelligence at Immersive, has noted that the new measures may push companies away from reporting ransomware incidents.
To address these concerns, the government will offer advice and support to victims, including informing them that making a ransom payment may risk breaking the law if the money is sent to sanctioned cybercriminal groups. Victims who believe they have no alternative but to pay may find ways around the ban to make payments, such as using third-party intermediaries.
In addition, businesses not covered by the ban will be required to notify the government of any intent to pay a ransom to attackers. This measure is aimed at creating transparency and preventing a potential "two-tier system" for businesses and entities not covered by the ban.
NHS England has urged its suppliers to commit to strong cybersecurity practices due to an "endemic" ransomware threat. A survey in Italy showed that 43% of organizations still admitted to paying ransomware payments, despite it being illegal. This highlights the need for stricter measures to combat ransomware attacks and protect essential services.
The proposal received three-quarters support during a public consultation launched in January 2025. The UK's anti-ransomware measures are part of a broader effort to strengthen the country's cybersecurity defences and protect its citizens from the growing threat of cyber-attacks.
%20in%20the%20UK%20are%20now%20prohibited%20from%20making%20ransomware%20payments%2C%20as%20confirmed%20by%20the%20government.){kind=link}