Writing in Fraud Intelligence, Senior Associate James Broomhall discusses the complexities of arguments for and against ransomware payment bans, in light of recent cyberattacks against Jaguar Land Rover, M&S and Asahi.

James’ article was published in Fraud Intelligence, 2 December 2025.

When Jaguar Land Rover’s operations came to a complete standstill following a cyberattack on August 31, 2025, it marked more than just another corporate breach. Described as potentially the most damaging cyberattack in British history, with estimated eventual damage to the British economy of £1.9 billion, the incident crystallised a fundamental question that has long troubled policymakers, law enforcement, and corporate boards: should paying ransoms to cybercriminals become a criminal offence?

The attacks on three household names this year – JLR, which had to shut down all global operations, Marks & Spencer, whose attack in April 2025 cost the company an estimated £300 million and forced it to suspend online operations for 46 days, and Asahi, which saw the brewery taking orders by fax machine – have exposed the vulnerability of even the most established brands to a threat that has evolved far beyond its origins.

From Opportunism to Industrial-Scale Extortion

Ransomware has rapidly evolved from a mere nuisance to a serious national security threat. Experts predict that by 2031, global damages could surpass $275 billion, with attacks occurring every two seconds.

The professionalisation of cybercrime is perhaps nowhere more evident than in the ransomware-as-a-service model that has emerged. DragonForce, the group that attacked Marks & Spencer, operates as a type of cybercrime franchise, providing ransomware as a service to other cybercriminals while taking a 20% commission on ransoms collected. This distributed model allows technical expertise to be commoditised, enabling affiliates to launch sophisticated attacks without developing their own tools.

The JLR incident demonstrates the human cost of this industrialisation. The company sits at the centre of the UK’s largest automotive supply chain, directly employing 40,000 workers while supporting an estimated 120,000 to 200,000 additional jobs across hundreds of supplier companies. Industry surveys reveal that one in six businesses in JLR’s supply chain have already implemented redundancies or zero-hour contracts, illustrating how a single successful attack can cascade through an entire economic ecosystem.

More troubling still is the targeting strategy that has emerged. The Scattered Spider group, which has been linked to attacks on both M&S and JLR, operates by exploiting stolen credentials rather than traditional technical vulnerabilities, using sophisticated social engineering tactics to trick helpdesk staff into resetting passwords. This represents an evolution from attacking systems to attacking people, a shift that renders many traditional security measures ineffective.

The Case for Prohibition: Legal and Policy Arguments

The UK government’s position has hardened considerably. In July 2025, the government confirmed plans to ban ransomware payments by public sector bodies and operators of critical national infrastructure, with strong support for the proposal from respondents. This follows a consultation that outlined three key proposals: a targeted ban for the public sector and critical infrastructure, a payment prevention regime for other organisations, and mandatory incident reporting.

From a criminal law perspective, the rationale for prohibition is straightforward: paying ransoms directly finances criminal enterprises and incentivises future attacks. The principle is no different from the long-standing policy against negotiating with terrorists, once payment becomes predictable, targets become more valuable. The former head of the National Cyber Security Centre has argued that attacks are fuelled because there is no legal barrier to victims paying and then claiming back expenses on insurance, making payments illegal would make attacks on impacted industries unprofitable for ransomware actors.

There is also compelling evidence that payment rarely achieves its intended purpose. A Cybereason study found that less than half of firms that paid a ransom demand recovered their data and services uncorrupted, while 80% of organisations that paid were hit by a second ransomware attack, often suspected by the same threat actor. This suggests that payment establishes the victim as a reliable target rather than resolving their predicament.

The economic logic is equally stark. If payments are outlawed, entire sectors become unattractive targets. Attackers pursue ransomware for financial gain; remove the prospect of payment, and the incentive structure collapses. This is particularly relevant for critical national infrastructure, where disruption can have life-threatening consequences. The government has noted that an NHS organisation recently identified a ransomware attack as one of the factors that contributed to a patient’s death.

The Counterarguments: Practical and Ethical Concerns

Yet the debate is far from settled, and the practical objections to a payment ban are substantial. The most immediate concern is the risk of business failure. Many organisations, particularly smaller ones, face an existential choice when encrypted: pay the ransom or cease operations. For critical sectors like healthcare and emergency services, precisely those covered by the proposed ban, system downtime is not merely expensive; it can be fatal.

Critics argue that the ban risks creating a two-tier system, in which organisations not covered by the ban become more desirable targets, potentially making small and medium-sized enterprises with limited cybersecurity resources more exposed to ransomware attacks. There is historical precedent for displacement effects in crime policy – when one target becomes too difficult, criminals adapt their targeting rather than abandoning the enterprise entirely.

The enforcement challenge is equally formidable. There are concerns that mandatory reporting and payment restrictions could drive ransomware responses underground, with organisations fearing reputational damage or regulatory scrutiny, prompting them to mislabel incidents. The opacity this creates would undermine law enforcement efforts and prevent victims from receiving appropriate support during attacks.

Perhaps most troubling is the question of culpability. From a criminal law perspective, ransomware victims are precisely that – victims. The proposal to impose criminal sanctions on those who pay after being extorted sits uncomfortably with fundamental principles of justice. Respondents to the government consultation clearly indicated concerns about revictimising victims through penalties, and rightly so. The victim of an assault who complies with threats is not prosecuted; why should the victim of digital extortion face criminal liability?

The JLR case illustrates the complexity. The company reportedly had no active cyber insurance coverage at the time of the attack, unlike M&S which was covered up to £100m in losses through insurance. Had a payment ban been in force, JLR would have faced a stark choice: accept potentially billions in losses and catastrophic supply chain collapse, or commit a criminal offence. This is not a choice that should be imposed lightly. It should be noted that JLR have not confirmed publicly whether they paid the ransom.

The Disclosure Dilemma: Transparency Versus Reputation

A separate but related challenge has emerged around disclosure obligations. Current law requires organisations to report qualifying data breaches to the Information Commissioner’s Office under UK GDPR, but there is no specific requirement to disclose ransomware payments. The government’s proposals would change this, creating mandatory reporting requirements for all ransomware incidents, regardless of whether payment is made.

The tension here is palpable. Public disclosure of successful attacks and payments made can severely damage corporate reputation and shareholder value. M&S’s market value dropped by £750 million within days of the attack becoming public, and analysts at Deutsche Bank estimate the attack has already sliced £30m off M&S’s annual profits and will continue to hit the retailer by £15m a week. For publicly traded companies, the financial consequences of disclosure can rival or exceed the direct costs of the attack itself.

This creates a powerful incentive to minimise disclosure or to frame incidents as routine IT problems rather than security breaches. M&S chairman Archie Norman asked Parliament how a company should deal with ransom demands but declined to reveal whether M&S paid the DragonForce attackers, demonstrating the reputational sensitivity even when addressing policymakers directly. He indicated that he had credible reasons to believe two significant cyberattacks targeting major British companies occurred in the four months leading up to July 2025, but were never publicly disclosed.

Yet from a public interest perspective, disclosure is essential. Without transparency, law enforcement cannot track attack patterns, threat actors remain anonymous, and other potential victims cannot learn from incidents. The proposed mandatory reporting regime attempts to solve this by creating obligations to report within 72 hours of a ransom being sought, followed by a full report within 28 days, with authorities then able to advise on whether payment would violate sanctions or other laws.

The question becomes whether legal compulsion is necessary to achieve transparency, or whether market mechanisms – insurance requirements, shareholder expectations, regulatory best practice- can achieve the same ends without criminalisation.

The Enforcement Reality: Do We Have the Tools?

The proposal to prohibit ransomware payments prompts a critical question: is UK law enforcement adequately prepared to manage the consequences? Current evidence points to significant capacity limitations. According to ISC2, the leading global nonprofit for cybersecurity professionals, the cybersecurity workforce has grown to 5.5 million, an 8.7% increase since 2022, adding 440,000 new roles. However, the 2023 ISC2 Cybersecurity Workforce Study reveals that demand continues to outpace supply, with a record shortfall of 4 million professionals needed to effectively protect digital infrastructure.

The UK faces similar constraints. While the National Cyber Security Centre and National Crime Agency provide valuable support, they operate with finite resources against an adversary that operates across borders and leverages sophisticated technical capabilities. The Department for Business and Trade issued a joint statement noting that the JLR attack had a significant effect on the broader supply chain for car manufacturers, yet government support has been limited to facilitating commercial lending rather than direct intervention.

The JLR case is instructive here. Four weeks into the attack, the UK government’s export credit agency responded by backing a private, five-year £1.5 bn loan to JLR to help pay suppliers – a reactive, financial response rather than an enforcement or prevention action. This suggests that even for attacks of historic magnitude, law enforcement capacity to disrupt attacks in real-time remains limited.

Qilin, the group that attacked Asahi, is now one of the most active ransomware groups, with 105 confirmed ransomware attacks and 473 unconfirmed claims in 2025. The scale of operations by groups like Qilin, Scattered Spider, and DragonForce suggests that law enforcement is playing catch-up rather than maintaining operational parity.

A Legal Framework for Resilience

As a criminal lawyer observing this debate, several principles emerge that should guide policy development.

First, any prohibition regime must distinguish between preparedness and culpability. Organisations that have invested in robust cybersecurity, maintained offline backups, and implemented incident response plans should not face the same consequences as those that paid ransoms after neglecting basic security hygiene. The law should incentivise prevention, not merely punish failure.

Second, the scope of any ban requires careful calibration. The proposal assumes that alternative measures such as backups, restoration plans, and cyber insurance are sufficiently mature across covered organisations, an assumption that may not hold across the board. Legal prohibition should be accompanied by a coordinated programme of support and investment in cyber maturity, particularly for smaller public sector bodies and critical infrastructure operators with limited resources.

Third, enforcement mechanisms must be proportionate. Criminal sanctions for ransomware payments by desperate organisations facing existential threats would be both unjust and counterproductive. Civil penalties, regulatory action, or governance consequences may be more appropriate. The government consultation revealed mixed feedback on penalties, with clear concerns about revictimising victims, suggesting that a nuanced approach is required.

Fourth, the payment ban cannot exist in isolation from wider resilience measures. The government continues to urge organisations to strengthen their ability to maintain operations in the event of a successful attack, including having offline backups, tested plans to operate without IT for extended periods, and well-rehearsed strategies for restoring systems from backups. This operational resilience must be the primary line of defence, with payment prohibition serving as a deterrent rather than a substitute for preparation.

Finally, transparency and support must accompany any compliance obligations. Respondents emphasised the need for sector-specific, accessible guidance to support implementation, especially for smaller organisations. If organisations face penalties for paying ransoms but receive inadequate guidance on prevention and recovery, the regime will fail both practically and ethically.

Conclusion: A Principle Under Pressure

The government has long maintained that it does not negotiate with terrorists. This principle reflects a calculation that while individual cases may seem to justify concessions, the systematic effect of payment is to encourage further attacks and endanger more lives. The question now is whether this same logic extends to ransomware criminals who have demonstrated the capacity to cripple critical infrastructure, devastate supply chains, and threaten public safety.

The attacks on JLR, M&S, and Asahi have made the abstract concrete. These were not hypothetical risks or theoretical vulnerabilities – they were real businesses, real workers, and real economic damage. The JLR attack demonstrates how a single IT system breach can halt a multi-billion-pound physical production line, while the Asahi incident forced the company to resort to taking orders by fax after ransomware paralysed modern systems.

The evidence suggests that ransomware has industrialised into a global service industry, operating with business-like efficiency and state-level sophistication. The ecosystem is mature, profitable, and increasingly brazen. Law enforcement, while dedicated, operates under resource constraints that limit its capacity to disrupt operations in real-time. Prevention, therefore, must come through changing the economic calculus – making ransomware unprofitable by removing the prospect of payment.

Yet the practical and ethical challenges remain substantial. Any prohibition regime must navigate the reality that many organisations – particularly smaller entities and those in critical sectors – may have no viable alternative to payment when facing encrypted systems and existential threats. The law must distinguish between those who exhaust all alternatives before paying under duress, and those who treat ransomware payments as a routine cost of doing business to be recovered through insurance.

The path forward likely involves several elements: a carefully scoped payment ban for those organisations with the greatest capacity and obligation to resist; robust support, guidance, and investment to build resilience before attacks occur; proportionate enforcement that prioritises prevention over punishment; and mandatory transparency to prevent payments from being concealed rather than prevented.

Perhaps the most important question is one of timing. Should prohibition come before or after capacity is built? The government’s proposal suggests the former – use prohibition to force rapid adaptation. Critics fear this places the cart before the horse, exposing organisations to catastrophic consequences before they have adequate defences.

What is clear is that the status quo is unsustainable. The attacks will continue, the costs will mount, and the threat will evolve. Whether through prohibition or some alternative mechanism, the UK must develop a coherent, enforceable framework that makes ransomware economically unviable while supporting victims and maintaining essential services. The principle against negotiating with criminals is sound. Whether it can survive contact with the complex reality of modern cyber extortion will determine not just policy, but the security and prosperity of critical national infrastructure and the economy it supports.

As one cybersecurity expert aptly observed about the JLR incident: this is how security often improves – not from foresight, but from disaster. The question is whether we learn the lesson before the next crisis, or after.