UK introduces sweeping restrictions on ransomware payments to curb cyber extortion
The British Government has unveiled what it calls one of the world’s toughest anti-ransomware regimes, outlawing ransom payments across the entire public sector and all organisations classed as critical national infrastructure. Private-sector victims that fall outside those categories must notify officials and secure approval before any money can be transferred to cyber criminals.
How the new framework works
Hospitals, councils, schools, energy companies and a dozen other critical sectors must refuse ransom demands outright. Every attack affecting businesses beyond that list must be reported to the Home Office, which will decide whether payment is permissible. Officials will screen proposed transactions for links to sanctioned entities and give technical guidance intended to help firms recover without funding criminals.
The law also introduces a compulsory incident-reporting duty for all ransomware victims. Ministers argue that mandatory disclosure will give the National Crime Agency a clearer national threat picture and allow faster disruption of active campaigns.
Why ministers acted
Ransomware remains the most acute cyber risk to UK organisations. High-profile attacks on Marks & Spencer, the Co-operative Group and Harrods have demonstrated how criminals can halt operations and leak sensitive data through double-extortion tactics. Marks & Spencer alone expects losses of about £300 million from a ransomware incident that began in April.
Last year an assault on a London pathology laboratory forced NHS hospitals to cancel procedures, contributing to Britain’s first fatality linked directly to cybercrime. The Government contends that banning payments for the most vital services and exposing every other payment to scrutiny will diminish the expected payday for attackers and make the UK a less attractive target.
Alignment with international moves
Australia introduced a similar model in 2024, requiring businesses to report ransom demands and blocking payments by critical infrastructure providers. Westminster’s approach goes further by placing an outright prohibition on the broader public sector and by formalising a permission system for private companies. Policymakers believe the dual track balances economic reality with national-security imperatives while giving law-enforcement agencies early warning of active threats.
Industry and expert reaction
Retail, financial-services and healthcare bodies welcomed the clarity, describing the rules as a decisive step toward a safer digital economy. Cyber-security specialists also praised the focus on transparency, though some warned that criminals often exploit targets opportunistically and may simply continue attacking in hope of finding less compliant victims. They suggested that only a universal payment ban would fully neutralise the ransomware business model.
Next steps for organisations
The Home Office plans to publish detailed guidance before the law takes effect later this year. In the interim, companies are urged to review incident-response plans, ensure backups are resilient to sabotage and verify that cyber-insurance terms align with the forthcoming payment-approval process.
With global ransomware revenues topping one billion US dollars in 2023, officials say the UK cannot rely on voluntary restraint. The new legislation places the burden of compliance squarely on boards and executives, signalling that silent pay-offs are no longer an option.
Photo Credit: DepositPhotos.com