The UK government is moving forward with legislation to ban all public sector organisations and operators of critical national infrastructure (CNI), including the NHS, local councils, and schools, from making ransomware payments. This policy is part of a wider crackdown to remove the financial incentive for cybercriminals targeting public services.
Scope: Ban applies to government, health, education, local authority, and other CNI sectors, private sector businesses must notify the government before making ransom payments.
Mandatory Reporting: All ransomware incidents, whether or not a ransom is paid, must be reported. This is intended to equip law enforcement with greater intelligence to disrupt cybercriminals.
Private Sector Impact: Private companies must inform authorities if intending to pay ransoms, and payments to sanctioned groups or foreign states can be blocked.
Experts and industry leaders view the step as a positive move towards disrupting ransomware business models, but warn that it is only the start,
Sharp Increase in Attacks: Ransomware attacks in the UK have surged 63% in Q2 2025, with record numbers in healthcare, government, and retail sectors.
Business Impact: Around 1% of UK businesses (roughly 19,000 companies) suffered a ransomware incident in the last year, compared to under 0.5% in 2024. Average recovery costs (excluding ransom) now exceed £2 million, and average ransom demands have doubled to over £4 million.
Targets and Techniques: SMEs, along with large firms, face growing pressure, as attackers increasingly automate methods and use data theft as leverage.
Risk Displacement: There is consensus that restricting payments for large public services could shift ransomware threat towards “softer targets” like SMEs and private sector organisations, which are typically less well-resourced.
Insurance Challenges: Cyber insurance providers are tightening conditions and often exclude ransomware from basic cover. Companies without proactive cyber hygiene, such as frequent backups and staff security awareness, may struggle to secure any cover.
Operational and Legal Pressure: SMEs must invest in preventative measures, as paying ransoms is no longer a default option. They also face greater regulatory expectations around reporting incidents and seeking government guidance when attacked.
Industry voices stress that legislation alone will not solve the ransomware crisis. To thrive in the new landscape, all businesses, especially SMEs, should:
The UK’s ransomware payment ban marks a major shift in cyber security strategy. While it targets criminal incentives, real resilience depends on continuous prevention and collaboration across all business sectors.
SMEs should seize this moment to build digital resilience and stay active in shaping their response, not just for compliance but for long-term success.
