Pay or Rebuild? Your Ransomware Response Decision

When Rhysida set a Friday deadline for Berlin to pay 30 bitcoins, the city made its choice public immediately: no payment. For most organizations facing a similar ultimatum, the decision isn't predetermined by policy statements. It's a high-stakes judgment call that your incident response team, legal counsel, and executive leadership must make under extreme time pressure.

Here's how to structure that decision before the clock starts ticking.

The Decision You're Facing

You've confirmed ransomware deployment. The attackers claim they've exfiltrated data and will publish it if you don't pay within their deadline. Your systems are encrypted or partially accessible. You need to choose: pay the ransom, refuse and rebuild, or negotiate for time while you assess your position.

This isn't about "never negotiate with criminals." It's a risk calculation with regulatory, operational, and reputational dimensions. Berlin had 12,000 systems to examine after detecting the attack on Aug. 14. Your scope might be smaller, but the complexity is identical: you're making a choice with incomplete information.

Key Factors That Affect Your Choice

Data classification and regulatory exposure. If the exfiltrated data includes protected health information under the Health Insurance Portability and Accountability Act, personally identifiable information subject to the General Data Protection Regulation 72-Hour Notification Requirement, or payment card data under PCI DSS, your decision triggers mandatory breach notification and potential enforcement action regardless of whether you pay. Berlin's admission that "public and non-public data may have been taken" between Aug. 7 and Aug. 12 means notification obligations kicked in whether or not they paid Rhysida.

Backup integrity and recovery time objective. Can you restore from clean backups within your operational tolerance? If your recovery time objective is 72 hours and your backup restoration testing shows you can meet it, payment becomes a data exposure decision, not a business continuity one. If you can't restore critical systems within acceptable timeframes, you're weighing operational shutdown against ransom payment.

Evidence of exfiltration vs. encryption-only. Some ransomware variants only encrypt without stealing data. Others, like Rhysida's double-extortion model, claim data theft. Your forensic investigation needs to confirm whether data left your environment. Berlin's forensic work revealed exfiltration occurred before the attack was detected on Aug. 14, fundamentally changing the decision calculus.

Payment feasibility and legal constraints. Can you legally pay? If the attacker is on OFAC sanctions lists or operates from a sanctioned jurisdiction, payment violates U.S. law regardless of your operational needs. Rhysida's suspected connections to Russia complicate this calculation, though Berlin officials noted "such connections cannot be ruled out" rather than confirmed.

Credential compromise scope. If attackers obtained administrative credentials or Privileged Access Management system access, payment doesn't eliminate their ability to re-enter your environment. Berlin confirmed that passwords for "certain specialized applications" were compromised, stored in files with names like Password.docx. Even if they'd paid, those credentials would still require rotation and access architecture redesign.

Path A: Refuse Payment and Rebuild

Choose this path when:

• You have tested, verified backups with recovery time objectives you can meet
• The exfiltrated data doesn't include high-sensitivity categories that would trigger severe regulatory penalties or immediate harm to data subjects
• Your forensic investigation confirms the attack vector and you can remediate it before restoration
• Your legal counsel confirms no sanctions violations but also no legal prohibition on your refusal
• Your crisis communications team can manage the reputational impact of potential data publication

What this requires: Immediate activation of your Computer Security Incident Response Team, coordination with external forensic investigators, systematic restoration from known-good backups, complete credential rotation across your environment, and preparation for regulatory notifications under the General Data Protection Regulation or applicable state breach notification laws.

Berlin chose this path. Their two affected departments remain operational with "some operational restrictions," including suspended VPN access that forced staff back to office computers. This is containment, eradication, and recovery in action, even if it's disruptive.

The regulatory exposure you're accepting: If Rhysida publishes the data as threatened, Berlin faces potential General Data Protection Regulation enforcement for the compromise of personal data, regardless of their refusal to pay. The 72-Hour Notification Requirement clock started when they confirmed exfiltration, not when data appears publicly. Your refusal to pay doesn't reduce your notification obligations or your potential liability for inadequate security controls.

Path B: Pay and Contain

Choose this path when:

• Your backup restoration timeline exceeds your operational tolerance and business continuity depends on rapid decryption
• The operational harm from extended downtime exceeds the ransom amount by an order of magnitude
• Your forensic investigation confirms limited credential compromise and you can secure your environment post-payment
• Legal counsel confirms payment doesn't violate sanctions and your cyber insurance covers ransom reimbursement
• You've exhausted negotiation attempts to reduce the amount or extend the deadline

What this requires: Cryptocurrency acquisition through your incident response retainer or cyber insurance carrier, communication with the attacker through secure channels (often managed by your incident response firm), simultaneous forensic investigation to identify and remediate the entry vector, complete environment hardening before you restore access, and regulatory notifications identical to Path A.

The risk you're accepting: Payment doesn't guarantee functional decryption keys. It doesn't prevent data publication. It doesn't remove the attacker's access if they maintained persistence through compromised credentials or backdoors. And it funds future attacks against other organizations.

The British Library refused to pay Rhysida 20 bitcoin in 2023. The group published around 600 gigabytes of stolen files, including staff details that forced some employees to relocate. Payment might have prevented publication, but it wouldn't have eliminated the breach notification requirements or the security remediation work.

Path C: Negotiate for Time

Choose this path when:

• Your forensic investigation is incomplete and you need to understand the scope before committing to either path
• Your backup restoration is in progress but you need more time to verify integrity
• You're waiting for legal guidance on sanctions compliance or regulatory notification timing
• Your crisis communications team needs time to prepare stakeholder messaging

What this requires: Engagement through your incident response firm or legal counsel, not direct communication with the attacker. Clear internal decision authority so negotiation doesn't become indefinite delay. Continued forensic investigation and restoration work in parallel, not as a substitute for decision-making.

Berlin didn't negotiate. They made their position clear immediately: "Berlin will not give in to blackmail." This eliminated negotiation as a tactic but also removed any ambiguity for internal stakeholders and the public.

Summary Matrix

Your decision framework should exist before the attack. Berlin's immediate refusal suggests a pre-established policy position. Your organization needs the same clarity: decision authority, payment approval process, legal consultation triggers, and communication protocols documented in your incident response plan before Rhysida or its successors set your deadline.

The worst choice is indecision. Pick your path based on the factors you can verify, execute it completely, and document your reasoning for the regulatory inquiries that will follow regardless of which path you choose.