Should utilities ever pay a cyber ransom?
Cyber attacks are becoming faster, more sophisticated and increasingly difficult to prevent entirely. As new legislation raises the bar on cyber resilience, how can utilities prepare for a successful attack? And are there circumstances in which paying a ransom could ever be justified?
By Tom Idle, features writer
Should utilities ever pay a cyber ransom?
Cyber attacks are becoming faster, more sophisticated and increasingly difficult to prevent entirely. As new legislation raises the bar on cyber resilience, how can utilities prepare for a successful attack? And are there circumstances in which paying a ransom could ever be justified?
By Tom Idle, features writer
There is a simple answer to the question of whether a utility company should ever pay money to cyber criminals: no.
However, cyber attacks are rarely simple, and when you’re at the centre of one, the previously unthinkable can quickly become a live consideration. If hackers have penetrated systems, operations are being disrupted and nobody can say with certainty when they will be restored, executives are no longer debating an abstract principle. They may instead be weighing the continuity of essential services against the risks of funding criminals, while trying to establish what information has been stolen, whether it will be published, what their legal obligations are and whether paying would actually solve anything.
For companies responsible for keeping water flowing and the lights on, those stakes are unusually high. Cyber attack has topped Utility Week and Marsh’s annual ranking of risks facing utilities in four of the past five years. This year its score increased from 16.07 to 17.59, significantly extending its lead, while the average perceived likelihood across the wider range of digital and security risks rose to its highest level in five years.
The shift is not simply about more attacks; it reflects a growing recognition that cyber is now an operational risk which cannot realistically be eliminated. The question utilities need to ask is no longer simply, ‘how do we stop an attack?’, it is increasingly, ‘what happens when one succeeds?’
Kelly Butler, UK cyber lead and managing director at Marsh, says the instinct around ransom payments is understandable. “Everyone’s first instinct is, of course, don’t pay,” she says. Marsh advocates putting companies in the strongest possible position to avoid making a payment. Where Butler draws the line, however, is an outright prohibition: “You’re a victim of crime, and if there’s health and safety on the line, you need to make the best choice for your business.”
It is a distinction that is particularly important for utilities because a company facing the publication of corporate information is one thing, but an operator struggling to restore systems necessary for an essential service could potentially be something much more serious.
Access the report free here
There are legal constraints too. Payments cannot simply be made to any threat actor, and organisations must understand who they are dealing with before determining whether a transaction would itself be unlawful. Engaging with an attacker also does not necessarily mean paying them. Specialist negotiators can be used to establish who is behind an attack, assess their previous behaviour, determine what information they actually possess and potentially buy time while technical teams attempt to restore systems. That intelligence can itself shape whether negotiation makes sense.
And, increasingly, the identity of the attacker matters. Holly Waszak, head of cyber claims at Marsh, says threat-actor behaviour has become less predictable, pointing to intelligence around groups where notoriety and “bragging rights” may be as important as financial gain. In such circumstances, promises to delete information following payment may carry little weight.
The result is that there can be no straightforward playbook saying pay or do not pay. The better question is how a company avoids reaching the point where an attacker has enough leverage to make payment appear attractive.
Ransomware is changing
In 2025, Marsh recorded 668 cyber notifications, up from 618 the previous year, with around a quarter related to cyber extortion or ransomware. Unlike previous years, when individual events caused pronounced spikes in claims, Waszak says the latest increase came from a broader mixture of incidents, including third-party and supply-chain attacks. More significantly, ransomware does not necessarily look like ransomware anymore. When Marsh began systematically collating its claims data in 2021, more than 70% of relevant claims involved ransomware being deployed into victims’ systems. Waszak says that figure is now around 20%.
Attackers are increasingly opting instead to enter a network, steal information and use the threat of publishing it to extort the victim. Part of the reason is that businesses have got better at defending themselves. More robust backups have reduced the effectiveness of encrypting systems, while stealing data can be quicker and easier for the criminal.
That creates a different kind of crisis, because a company might successfully restore its operations but still face an extortion demand because commercially sensitive, operational or customer information has been taken. For utilities, that is significant because the information at risk extends beyond personal data.
The UK Utilities Risk Report 2026 research identified growing concern about operational and asset information spread throughout supply chains. Contractors can hold files revealing details of physical sites and infrastructure, while smaller suppliers may not have security equivalent to that of the utility itself. At the same time, dependence on interconnected cloud and technology providers is creating potential single points of failure that companies may not even realise they have.
The other problem is speed. Waszak points to CrowdStrike research putting average “breakout time” – the period between an attacker entering a system and moving laterally through the network – at 29 minutes. The fastest recorded was just 27 seconds. “Are you ready within 29 minutes to be making decisions about shutting down parts of your network or how you’re going to respond?” she asks. “It would be a lot to ask of someone in 29 minutes to make the right decisions.” That is why incident preparedness has to extend far beyond the cyber team according to a participant at a recent roundtable event.
Functions normally managed digitally suddenly had to revert to manual processes. Communications had to move away from potentially compromised systems. External specialists had to be mobilised, and restoring individual applications was complicated by the dependencies between them. For utilities, where corporate IT sits alongside operational technology controlling physical infrastructure, the potential complexity is greater still.
“Are you ready within 29 minutes to be making decisions about shutting down parts of your network or how you’re going to respond?”
Holly Waszak, head of cyber claims at Marsh
Planning for the inevitable
Resilience is becoming as important as prevention. One utility risk specialist interviewed for Utility Week's deep dive report into cyber and security risks described organisations as “running fast just to stay still”. The objective cannot simply be to build ever-higher walls around systems, but to ensure the company can contain an incident and continue operating when those walls are breached.
Legacy operational technology (OT) remains a particular weakness, with some systems controlling infrastructure-run software that cannot easily be patched, leaving vulnerabilities that have to be managed rather than removed. Utilities are simultaneously under pressure to connect more systems and extract more operational data to improve efficiency – potentially creating new pathways between previously segregated environments.
Preparation, therefore, must test the organisation rather than just its technology. Who can order part of the network to be isolated? What happens if the executive given that authority in the incident response plan cannot be reached? Where are insurance policies and response documents stored if the corporate network is inaccessible? How will executives communicate if email and Teams cannot be trusted? Which forensic, legal and negotiation specialists are already lined up?
And can the business operate for weeks rather than hours without its normal systems? At a Utility Week and Marsh workshop held in London, those questions repeatedly emerged from a number of utility practitioners. One described simulations continually revealing new problems, including policies that required senior authorisation for decisions that operational teams might have to make immediately during a live attack. Another organisation moved to 24/7 security monitoring after an earlier ransomware incident exposed the inadequacy of alerts simply sitting in an IT inbox overnight.
Preparedness also means knowing which people are most likely to be targeted. Despite increasingly sophisticated technology, human behaviour remains one of the easiest routes into an organisation. Helpdesks are a particular concern because staff are trained to solve problems quickly and attackers exploit that instinct to help.
Utilities are responding with phishing simulations, targeted training for teams including IT, finance, HR and supply chain, and stronger verification of unusual requests. AI is making that challenge harder. As Butler says, it is already making social engineering “much more sophisticated”, improving the grammar, speech and realism of scams while allowing criminals to produce them at scale. “They’re not targeting you – they’re targeting everyone,” she says. “They’re just looking to find the vulnerabilities.”
Deepfake video and audio adds another layer, allowing attackers to impersonate senior executives or even fabricate compromising material and demand payment not to release it.
The expectation that utilities prepare for failure is also increasingly being reflected in regulation. Existing obligations under the Network and Information Systems Regulations require operators of essential services to take appropriate measures to manage cyber risks and report significant incidents. Ofgem is meanwhile using its Enhanced Cyber Assessment Framework to raise expectations around governance, monitoring, incident response and supply-chain assurance, with networks expected to meet the enhanced framework by 2027.
The Cyber Security and Resilience (Network and Information Systems) Bill will take that further. Its purpose is to strengthen and expand the existing NIS regime governing the systems used to support essential activities.
The direction of travel is clear: cyber resilience is becoming a core responsibility of organisations running critical national infrastructure rather than something that can be delegated to an IT department. But tighter rules are arriving at the same time as the threat landscape becomes more difficult. State-backed actors are targeting infrastructure for disruption rather than financial gain; supply-chain dependencies are multiplying; AI is making impersonation easier; and digitalisation is connecting systems that were once separate. The attempted attack on Polish energy infrastructure at the end of 2025 demonstrated what that combination could mean, with attackers attempting to interfere with operational technology and deploy malware designed to permanently erase data.
None of this makes paying a ransom desirable. It does, however, suggest that arguing over whether utilities should pay can miss the more useful question. The leverage behind a ransom demand comes from what the attacker can deny the victim: access to systems, confidence in its backups, control over stolen information or, ultimately, the ability to continue operating.
Every improvement in resilience reduces that leverage.
A utility that can isolate an attack, maintain its critical operations, restore trusted backups, communicate securely, support vulnerable customers and understand exactly what information has been stolen is in a far stronger position to refuse a demand than one trying to invent those arrangements during the crisis.
Insurance is part of that resilience, but it is not an instant escape route.
That may be the most useful lesson for utilities. Cybersecurity cannot be reduced to stopping somebody getting through the door. The sector is moving towards an assumption that, eventually, somebody might. The real measure of resilience is what happens next – and whether the organisation has done enough beforehand to ensure that, when a criminal demands money, saying “no” remains a decision it can afford to make.
