Ransomware payment: insurance cannot replace the crisis decision

A ransom demand is not an insurance instruction

The Federal Office for Cyber Security advises against paying ransomware demands: payment does not guarantee recovery or non-publication and funds the criminal model. If payment is still considered, its guidance strongly recommends discussing it with cantonal police. A cyber policy may impose prior consent, use of approved negotiators, legality checks and sublimits; cover does not make payment safe or appropriate. First isolate systems, protect backups and activate the response plan. Decision authority must sit with management informed by incident, legal, law-enforcement and insurance expertise.

Run four workstreams at once

Technical responders preserve evidence, contain access and test clean restoration. Legal and privacy advisers assess contracts, criminal reporting and whether a personal-data breach creates a likely high risk requiring notification to the FDPIC. Management maps critical services and cash consequences. The insurance team notifies promptly and obtains written authority for vendors and expenditure. Keep one decision log recording time, facts, options and approvals. Do not let a negotiator, insurer or IT supplier silently become the company’s decision-maker; each sees only part of the risk.

A hypothetical encrypted clinic

A small clinic loses access to scheduling and billing while clinical devices remain isolated. Its response lead disconnects affected networks, protects offline backups and calls the insurer’s approved incident firm and cantonal police. Clean recovery appears possible within two days, so management rejects payment and activates manual scheduling. Privacy counsel evaluates the stolen-data evidence and notification threshold. The policy funds defined response costs subject to terms. The example is not a guarantee: a different attack, sanctions issue or corrupted backup would change the choices.

Payment may promise speed and create new uncertainty

Refusing supports public guidance and avoids financing criminals, but recovery can be slow and costly. Paying may produce a decryptor, yet it can fail, encourage repeat extortion, raise legal concerns and not stop disclosure. Insurance limits soften cost but do not restore reputation, accurate data or safe systems. Public communication can protect customers while revealing too much about the investigation. Compare time-to-clean-recovery, life or safety impacts, evidence of exfiltration and legal constraints. Never reduce the question to ransom amount versus downtime estimate.

Pre-authorise the decision structure

Before an incident, name executives with authority, insurer contacts, breach counsel, forensic responders, police liaison and backup owners. Test after-hours numbers and offline restoration. Record policy consent requirements, exclusions, waiting periods, extortion sublimits and vendor rules. Prepare manual operations and a bilingual stakeholder template without promising facts not known. During the event, notify, preserve, contain and document; discuss any contemplated payment with competent authorities and advisers. After recovery, rotate credentials, close the entry path and retain evidence. Insurance should finance a governed response, not invent governance under pressure.

A cryptocurrency wallet or payment intermediary should never be created informally by one employee during the attack. If the company’s approved process cannot perform a proposed transaction lawfully and transparently, that is a governance signal, not an inconvenience to bypass. Preserve screening, ownership, accounting and authorisation evidence for any crisis payment or emergency purchase.