Recovery

No matter what, recovery from a ransomware attack can be messy. If you decide to pay and get a decryption key—and if it works—there is usually a considerable amount of cleanup because the attackers shut down servers and databases not designed to shut down hard. If you don’t pay, rebuilding networks from backups is time consuming.

Verify. For attackers, ransomware is a business, and they want to keep their reputations intact.

Know what’s up for debate. For large and more mature institutions, forensic teams can generally figure out how to find or trigger the decryption key.