75% of UK Businesses Would Break a Ransomware Payment Ban to Save Their Company, Risking Criminal Charges

Core Viewpoint - There is a significant gap between the support for a ban on ransomware payments and the willingness to comply with such a ban in practice, particularly in the private sector [1][3]. Group 1: Survey Findings - 96% of UK business leaders from companies with revenues over £100 million believe that ransom payments should be banned in both public and private sectors [1][3]. - 99% of respondents support a ban on ransom payments in the private sector, while 94% support a ban in the public sector [1][3]. - Despite the strong support for a ban, only 10% of private sector respondents indicated they would comply with a ban if attacked, while 15% were neutral on compliance [3]. Group 2: Government and Cybersecurity Implications - The proposed ban would legally prohibit ransom payments by public sector organizations and critical national infrastructure operators, requiring other businesses to notify the government of any intent to pay a ransom [2]. - Over a third (34%) of those supporting the ban believe it would lead to increased government support for cyber resilience, while another third (33%) think it would reduce the frequency of attacks by removing incentives for attackers [4]. Group 3: Cybersecurity Landscape - The latest Cyber Security Breaches Survey 2025 reported that approximately 43% of UK businesses (around 612,000) experienced a cyber security breach or attack in the past year [5]. - Almost all respondents (98%) indicated that cyber readiness and recovery would be a top spending priority, emphasizing the need for resilience over reactive payments [6]. - Recovery from a cyberattack takes an average of 24 days, which can lead to significant financial losses for large organizations and potential bankruptcy for smaller ones [7]. Group 4: Expert Opinions - Experts suggest that paying a ransom rarely guarantees recovery and may increase the likelihood of future attacks, advocating for a well-enforced ban alongside greater investment in prevention and recovery [8]. - The ongoing threat of ransomware and cyberattacks necessitates that companies enhance their emergency preparedness and cyber resilience to maintain operations during incidents [8]. Group 5: Research Methodology - The survey was conducted by Censuswide, involving 1,000 UK business leaders from companies with revenues exceeding £100 million, including various executive roles [9][10]. Group 6: Company Overview - Commvault is recognized as a leading provider of cyber resilience and data protection solutions, serving over 100,000 organizations globally [11].