Is ransomware losing its grip?

According to Databarracks’ newly published Data Health Check 2025, organisations are turning the tide – opting to recover from backups instead of paying ransoms.

The annual survey of 500 IT decision-makers – released just days after the UK Government confirmed new ransomware rules – reveals a significant shift in how organisations respond to attacks.

Just 17% of those hit by ransomware in the past year paid the ransom – down from 27% in 2024 and 44% in 2023. In contrast, 57% recovered from backups.

The shift is driven in part by stronger backup strategies. The data shows that 72% maintain air-gapped backups and 59% use immutable backups. The report also highlights a growing resolve against paying attackers, with 24% of organisations now having a formal policy never to pay a ransom – double the figure reported in 2023.

Government’s Proposed Crackdown on Ransomware Payments

Under the Home Office’s proposals, public sector bodies and operators of critical national infrastructure, like the NHS, local councils and even schools, would be banned from paying ransom demands, with the government saying nearly three-quarters (72%) of consultation respondents were in support of such a move.

Around two-thirds of respondents (68%) agreed that a targeted ban could help cut the flow of funds to ransomware gangs, hitting their income directly, while six in ten (60%) reckoned it could also put cyber-criminals off targeting organisations covered by the ban.

This shift comes as the UK Government confirms its new ransomware policy, which includes a ban on ransom payments by public sector bodies and Critical National Infrastructure operators, plus mandatory reporting and pre-payment notification for the private sector.

The government hopes that such a ban might disrupt the business model that fuels cyber-criminals’ activities and make vital services a less attractive target for ransomware groups.

Under the plans, businesses not covered by the ban would be required to notify authorities of any intent to pay a ransom, a particularly striking move following the recent disclosure of the M&S chairman in parliament that multiple attacks against major businesses have gone unreported.

The government said that once notified, it could provide at-risk businesses with advice and support, including telling them if any ransom payment breaks the law by sending money to sanctioned cyber-criminal groups, many of which are based in Russia.

Mandatory reporting is also being developed, which would equip law enforcement with essential intelligence to hunt down perpetrators and disrupt their activities. The recent consultation showed strong support for a mandatory reporting regime that could better protect British organisations and industry.

Recommended reading

• ITSX Summit | Sustaining and Enhancing Service Delivery Amid Disruption
• CISOs Rely on AI To Reduce Costs and Enhance Cyber Resilience
• Cloud Outages Top Risk for UK IT Leaders, New Study Finds

James Watts, managing director at Databarracks, commented: “The government’s new stance is bold – but the data shows the direction of travel was already clear. In some sense, the policy is a formalisation of where UK businesses were already headed.

“Paying the ransom used to feel like the only option. Now, the best-prepared organisations are recovering faster, more reliably, and without funding criminals. Air-gapped and immutable backups are giving organisations the confidence to say no – and back it up.”

The Data Health Check 2025 also shows that improving backup processes is now the top IT resilience priority for UK organisations – ahead of both continuity planning and recovery testing.

“Recovery isn’t a last resort – it’s a strategy,” added Watts.

“The organisations that plan and rehearse their recoveries are the ones that come through an attack strongest. That’s how you beat ransomware – not by paying, but by preparing to recover.”