The United Kingdom is advancing plans to prohibit public sector bodies and critical national infrastructure groups, including the National Health Service, from paying ransoms to hackers. This prohibition targets local councils and schools, aiming to cut off financial support to criminal networks. Research indicates that nearly half of companies targeted by an attack ultimately pay the criminals to release their data or systems, while the median amount demanded by these attackers is currently rising, according to 2025 research from cybersecurity group Sophos.
The threat actors have become more advanced and meticulous in their targeting of companies, particularly vulnerable small and medium-sized businesses, over time. Haydn Brooks, chief executive of supply chain security group Risk Ledger, describes the current environment. “In 2026, the ransomware environment has evolved into a highly sophisticated, corporate-style ecosystem,” he says.
Related: Deputy charged over nude prisoner photos
UK Restricts Payments to Extortionists
Brooks notes that while ransomware groups operate like smart B2B operations to ensure data return, the legal and sanction risks of paying are at an all-time high. The British government is targeting the National Health Service and other critical sectors as part of a broader effort to prohibit payouts.
The capability to launch these attacks has been supercharged by malicious AI hacking tools. Dave Spillane, systems engineering director at Fortinet, highlights that confirmed ransomware victims rose 389 percent year-on-year in 2025. This surge is largely attributed to tools like WormGPT, FraudGPT, and BruteForceAI.
Related: Earth’s spacetime twist measured with high accuracy
In the time it would have previously taken to commit one ransomware attack, hackers can now target four separate organizations simultaneously. Spillane says the cost per attack has dramatically decreased, commoditizing sophisticated attacks, whereas the cost to defend is increasing. Shashi Kiran, chief marketing officer of tech group Nile, agrees that what required nation states earlier can be accomplished by individuals with half-baked skills leveraging the power of AI.
Deciding whether to pay remains one of the most divisive areas in cybersecurity. Jim Walter, a senior threat researcher at SentinelOne, takes a hard line against responding to ransoms. “Paying extortive threat actors only strengthens the ecosystem and the entities that enable it,” he says. Walter notes that threat actors cannot be trusted to delete data upon payment. Re-extortion and the ongoing monetization of stolen data are commonplace, he adds. “Paying absolutely does not guarantee recovery, it actually encourages further crime and extortion.”
