Ransomware can present an organization with an impossible choice, between losing access to, or control over, the organization's most sensitive data or funding an ever-growing criminal behemoth that has threatened and continues to threaten hospitals, schools, and critical infrastructure, not to mention private industry.

Yet often, an organization's options to avoid payment are limited, and attackers utilize tactics designed to create maximum pressure to ensure that payment is made.  Aside from the business and ethical issues that arise when assessing whether to make a ransomware payment, legal considerations abound, and can increase both the complexity of decision making and of risk surrounding such a payment.

Because of this, an organization's troubles do not simply end, when it pays to unlock its encrypted data or obtain deletion of stolen data.  Rather, making a ransomware payment can have repercussions that survive long after the underlying security incident has been resolved.