UK Plans Ban on Ransom Payments by Public Bodies, Businesses

The UK government announced a comprehensive plan to ban public sector bodies and operators of critical national infrastructure, including the NHS, local councils, and schools, from paying ransoms to cybercriminals. This move aims to disrupt the ransomware criminal business model following high-profile attacks such as those on the British Library, NHS hospitals, and major retailers like Marks & Spencer and the Co-Op, which have caused significant operational and financial damage. Private companies not covered by the ban will be required to notify authorities if they intend to pay ransoms, allowing the government to provide advice and ensure payments do not fund sanctioned criminal groups, many of which are based in Russia. The measures, supported by nearly three-quarters of consultation respondents, also include mandatory ransomware incident reporting to improve intelligence gathering and law enforcement response. Experts note that while UK public authorities are generally not known to pay ransoms, the clear ban is intended to send a strong signal to cybercriminals to deter attacks. The government emphasizes the need to protect essential services and maintain continuity in the face of evolving cyber threats.