After spending the first half of 2025 taking public comment on the matter, the UK government is moving ahead with legislation to ban ransomware payments for entities that receive public funds and critical infrastructure organizations.
The longtime debate about whether or not ransomware payments should be made illegal has been revived in the UK. If the UK passes the strictest of the new Home Office proposals for the public sector, it would be the first major economy to extend bans on payments this far.
The new CRI guidance does not call for a shutdown of ransomware payments, but does encourage victims to get in touch with law enforcement as soon as possible even if they intend to make a payment.
There was some hope that ransomware was finally on the wane as 2022 closed, but a Chainalysis study indicates that ransomware payments in cryptocurrency topped $1 billion for the first time in 2023 as there was even more activity than in the peak pandemic years.
The United States, EU members and select other countries (some 40 in total) have reached a formal agreement to refuse ransomware payments demanded of government agencies. At present, this has no impact on private organizations or companies.
2020 and 2021 saw massive increases and record costs, and ransomware payments continue to be well above what was seen in the more “normal” conditions prior to March 2020 despite a big 40% drop.