The UK government has announced plans to ban ransomware payments from public sector bodies and critical national infrastructure (CNI) operators, a move that could make the country the first to legislate such restrictions.

The proposed measures, part of a new consultation, aim to cut off funding streams to cybercriminal groups and strengthen transparency through mandatory incident reporting. Organizations outside the ban would still be required to notify authorities if they intend to pay a ransom.

Security Minister Dan Jarvis described ransomware as a “predatory crime” that threatens essential services and public safety, stressing the government’s commitment to dismantling the business model of cybercriminals. According to consultation results, 72% of respondents backed a targeted ban for the public sector and CNI, while 63% supported mandatory reporting.

However, cybersecurity experts caution that the ban may push ransomware groups to target private sectors more aggressively. Chris Atkinson of PA Consulting noted that while the ban would disrupt cybercriminals, it could also displace attacks to industries not covered by the law. Crystal Morin of Sysdig added that attackers may still pursue public sector organizations to steal sensitive data, which can be exploited or sold on the dark web.

Globally, most ransomware countermeasures remain voluntary. The UK’s move stands out for carrying the force of law, unlike initiatives such as the US-led International Counter Ransomware Initiative. While the UK public sector already avoids ransom payments, this proposal extends the policy to CNI and affiliated public bodies.

Experts warn that a total ban leaves organizations with fewer options during an attack, as recovery costs can sometimes exceed ransom demands. Despite this, the government believes mandatory reporting and stricter rules will bolster defenses and reduce financial incentives for cybercriminals.

Stay ahead of emerging cybersecurity threats. For the latest insights and updates on cloud security, follow SOC News.

News Source: ITPro.com