Should a Houston Business Pay the Ransom? A Decision Guide

That answer frustrates people in the middle of an attack, because the ransom note usually comes with a deadline and the decision feels like it has to be made before lunch. It doesn’t. This guide lays out the questions to answer in order, who should answer each one, and how to compare the demand with what staying offline costs. It sits alongside our page on ransomware incident response in Houston, which covers the response work itself.

Is it legal for a Houston business to pay a ransom?

Yes, in most cases. No federal or Texas law makes it a crime for a private company to pay a ransom. The legal exposure comes from who receives the money. If the group behind the attack, or the wallet it uses, is on the Treasury Department’s sanctions list, paying it can violate U.S. sanctions even if you had no idea who you were dealing with.

The Office of Foreign Assets Control spelled this out in its September 2021 advisory on ransomware payments. It says the U.S. government strongly discourages all private companies and citizens from paying ransom or extortion demands, and that civil penalties can be imposed on a strict liability basis. That means intent doesn’t matter. The same advisory names insurers and incident response firms that help with payments, so they carry the risk too, which is one reason they screen the attacker before anything moves.

The FBI and CISA take the same line. The joint #StopRansomware Guide says paying won’t ensure your data is decrypted, that your systems are no longer compromised, or that your data won’t be leaked. None of that makes payment illegal. It does mean that if you pay, you need a paper trail showing you checked.

What 6 questions should you answer before deciding?

Take these in order. Each one can end the conversation, and the first 2 settle it for most companies.

1. Is anyone’s safety at risk right now, such as patient care, a plant control system, or a building system people depend on?
2. Can you restore from backups that the attacker never reached, and has someone actually started a test restore?
3. What data was taken before the encryption started, and whose personal information was in it?
4. Has the response firm or your lawyer checked the group and the wallet against the sanctions list?
5. What does your cyber policy say about extortion payments, and has the carrier been told about the claim?
6. How many days of downtime would paying actually save, and what does each of those days cost you?

The second question matters more than any other. If clean backups exist and a test restore works, the ransom stops being a recovery tool. Some groups will still threaten to publish what they stole, and that turns it into a different question about data you’ve already lost control of. Paying can’t get that data back, and I’d be skeptical of any promise that it was deleted.

The third question catches people out. Encryption gets the attention, but CISA’s guide warns that attackers have also taken to copying data first and threatening to release it, and in Texas that can trigger notice duties no matter what you do about the ransom.

Who should make the call?

Not your IT provider, and not one person acting alone at 3 a.m. Each part of the decision has a natural owner, and the final yes or no should be written down and signed by whoever runs the company.

Our role in that table is the first row and the restore work that follows. We’re a managed IT and security provider, not a forensics firm or a negotiator. Your carrier will usually name the specialists, and our post on incident response cost in Houston explains who bills for what.

How do you compare the ransom with the cost of staying down?

Compare the demand with the days it would save, not with the whole outage. Even with a working decryption key, someone still has to rebuild, clean and check every system before people can trust it again. So the honest comparison is the ransom against the difference between recovering with the key and recovering without it. The bills that come either way are covered in our guide to ransomware recovery cost in Houston.

Here’s a way to put a floor under the cost of a day offline. BLS data puts the mean wage across all jobs in the Houston metro at $32.51 an hour for May 2025, according to its occupational employment series for the Houston area. Benefits and payroll taxes raise private employers’ costs by a factor of about 1.43, based on the June 2026 employer compensation figures. That works out to about $46.45 an hour per employee, or roughly $372 for an 8-hour day of people being paid while the systems are down.

That’s payroll only. It leaves out lost sales, overtime once you’re back, recovery fees and any penalties, so treat it as the least a day costs you. The national figures leave the same gap. The FBI’s 2025 Internet Crime Report logged more than 3,600 ransomware complaints and about $32 million in reported losses, and it notes that the loss figure doesn’t usually include lost business, time, wages, files, equipment or outside remediation.

Houston companies already know this kind of math from hurricane planning. If you have a continuity plan that says what a day without the office costs, use that number here. If you don’t, the table above is a reasonable place to start.

A ransom can be smaller than 10 days of payroll and still be the wrong call. If clean backups would get you running in 4 days and a key might get you running in 3, you’d be paying for 1 day, along with the sanctions risk and the chance the key only half works.

Why doesn’t paying end the incident?

Because the attack did several things and the payment addresses only one of them. Paying may get you a decryption key. It doesn’t remove whatever access the attackers used, and it doesn’t get back the data they copied. It also doesn’t change what you owe the people whose information was taken.

Texas law is clear on that last point. When a breach involves 250 or more Texans, the business must report it to the Texas Attorney General as soon as practicable and no later than 30 days after discovery, and affected people must be told within 60 days. The Attorney General publishes those reports. Paying the attackers doesn’t pause either clock, which is why our guide to ransomware reporting rules in Houston starts the reporting work on day 1.

There’s also a federal rule on the way. Under the Cyber Incident Reporting for Critical Infrastructure Act, covered companies will have to report a ransom payment to CISA within 24 hours of making it. CISA’s CIRCIA page says the final rule is still being written and that nobody has to report under it until it takes effect. Many Houston firms in energy, chemicals, healthcare and shipping are likely to fall under it, so it’s worth knowing which side of the line you sit on before the rule lands.

If you do pay, how should it be done?

Through specialists, after you’ve reported the attack, and never by someone on your team buying cryptocurrency on their own. OFAC’s advisory says it treats a prompt, complete report to law enforcement or CISA, plus continued cooperation, as a significant mitigating factor if a payment later turns out to involve a sanctioned party.

1. Report the attack to the FBI Houston field office or the IC3 before any payment is discussed.
2. Let the incident response firm and counsel screen the group and the wallet against the sanctions list, and keep their written findings.
3. Get the insurer’s consent in writing if the policy requires it, which many do.
4. Have a specialist handle any contact with the attacker and any payment, and ask for proof that the key works on a few of your files first.
5. Keep restoring from backups in parallel, because a key may be slow or only work on part of your data.
6. Record who approved the payment, the amount, the date and the reasons, and give that file to counsel.

Before step 1, it’s worth asking whether a free decryptor exists for the strain you’ve been hit with. The FBI may know of one, and the CISA guide recommends asking even when you can recover without it. Our post on free ransomware decryption tools covers where to look. The hour-by-hour checklist in what to do in the first hour of a ransomware attack covers containment, which comes before any of this, and our guide to ransomware attack response in Houston carries it through the first 24 hours.

How do you avoid facing the question at all?

Make the second question easy to answer. Backups that are kept offline or can’t be changed, tested with a real restore every quarter, are what let a company say no. OFAC lists offline backups, incident response plans, staff training and strong sign-in controls as steps that count in a company’s favor, so the same work also lowers your legal risk.

NIST’s ransomware risk management profile, revised in June 2026 to match version 2.0 of its Cybersecurity Framework, is a good checklist for a leadership team. I’d add 1 thing to it. Decide now who has the authority to approve a payment, and write that into your incident response plan. Deciding that during an attack, under a deadline, is how bad decisions get made.

If you want to know where you stand, our network assessment is free and shows what’s exposed, and our data backup services page explains how we set up and test restores. Plans and monthly rates are on our pricing page.

What Houston owners ask about paying a ransom

Is it illegal to pay a ransom in Texas?

Does the FBI tell businesses not to pay?

If we pay, do we still have to notify customers?

Can we get our files back without paying?

Will cyber insurance cover a ransom payment?

Does Uprite negotiate or pay ransoms for clients?

Prefer email or a phone call? Reach the team through our contact page.