Should you pay the ransom?
There is no Canadian law that bans paying a ransom, and no official guidance that tells you to. The Canadian Centre for Cyber Security says The decision to pay the ransom is up to your organization, and then lists every reason to be wary: paying does not guarantee you get your data back, it may break the law depending on who receives it, and the attackers may still leak what they took (Canadian Centre for Cyber Security, Ransomware playbook, ITSM.00.099, 2026).
We are not lawyers, and this is not legal advice. Before deciding anything, speak with a breach coach, your external or in-house counsel, and, if payment is on the table, a ransom negotiator from a professional incident response firm.
Most victims now refuse. Among Coalition’s policyholders hit by ransomware in 2025, 86 percent did not pay (Coalition, 2026 Cyber Claims Report, 2026). Across Verizon’s 2026 breach data, 69 percent of ransomware victims did not pay (Verizon, 2026 Data Breach Investigations Report, executive summary, 2026). The harder question is who decides, on what facts, and how quickly.
What does Canadian guidance say?
The Cyber Centre’s ransomware playbook is direct about the order of operations: Before you even consider paying, contact your local police department to report the cybercrime (Canadian Centre for Cyber Security, Ransomware playbook, ITSM.00.099, 2026).
On the law, it says it may be unlawful to pay ransom under laws against terrorism, money laundering, funding criminal organization activities, or sanctions legislation (Canadian Centre for Cyber Security, Ransomware playbook, ITSM.00.099, 2026). “May be” is doing real work there. It depends on who is on the other end, which you usually do not know on day one.
And on what paying buys, it warns that even after payment, attackers may come back for more, stay in your systems, target you again, or copy, leak or sell your data (Canadian Centre for Cyber Security, Ransomware playbook, ITSM.00.099, 2026).
If anyone in the chain is American, such as an insurer, a negotiator or a bank, US sanctions rules come into it too. The US Treasury’s advisory says The U.S. government strongly discourages all private companies and citizens from paying ransom or extortion demands, and that a person can be liable for paying a sanctioned group even if they did not know who it was (US Treasury OFAC, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments, 2021). Reporting to law enforcement early counts in your favour. The advisory is guidance, not law, but the sanctions it describes are.
What does paying buy, and what does it not?
| Paying might get you | Paying does not get you |
|---|---|
| A decryption key, which may work and is usually slow | A guarantee the key works, or that your files survive it |
| A promise to delete stolen data | Any way to check the promise was kept |
| Possibly a shorter outage | An end to your duty to assess the harm and notify people |
| Protection from being targeted again |
The second row is where much of the real cost now sits. In Coalition’s 2025 claims data, 70 percent of ransomware claims involved data theft as well as encryption (Coalition, 2026 Cyber Claims Report, 2026). A restore from clean backups does nothing about a copy someone else holds.
PowerSchool shows the limit of paying for deletion. It confirmed it paid a ransom as part of an attempt to have stolen student data deleted. The Toronto District School Board later learned the data was not destroyed (Toronto District School Board, PowerSchool cyber incident FAQ, 2025).
What have Canadian organizations decided?
Three cases, three different calls.
The University of Calgary paid about $20,000 in 2016 to keep every option open for recovering critical research data. A year later, its vice-president of finance said a breach coach had recommended paying (CBC News, 2016).
Saint John, New Brunswick, refused in 2020. A councillor said the attackers wanted $17 million to 20 million in bitcoin. The city built a new network instead, at about $2.9 million (CBC News, 2021).
LifeLabs paid in 2019, after asking the attackers to back up their claims, to get back stolen customer data. Ontario’s and British Columbia’s privacy commissioners later found it had not put reasonable safeguards in place. Paying did not close that question. The sources for all three are in the cyber incident tracker.
None of these was a policy applied. Each was a decision made under pressure, with different facts about backups, data and cost.
What actually decides the call?
In the exercises behind this template, rooms usually arrive with the ransom question already answered. They have a policy, and the policy says no. Watching them confirm it is not where the value is.
The value is in the what-if. The backups worked, but the data left. If we do not pay, it gets published. So do we pay? How would we even do it? Who signs it off? That is where rooms slow down, because the policy never covered it.
The facts that decide it in practice:
- Can you restore, and from what? Clean backups change everything. Untested ones change nothing.
- What was taken, and whose is it? This sets your notification duties, and they do not change if you pay.
- Who is on the other end? Sanctions screening is not optional, and it takes time.
- What does the insurer say? Call them before deciding anything.
- Who has the authority? The answer should be a name, not a committee that has never met.
A ransomware exercise is the place to find out whether your room can answer those five in the right order. The pack below is built to take your team past the policy and into the what-if.
How do you use this in your own tabletop?
Three questions that take a room past its ransom policy:
| For | Ask the room | Listen for |
|---|---|---|
| Technical | Can we restore without paying, and how sure are we the backups are clean? | A tested answer with a date, not an assumption |
| Leadership | The data was taken. If we do not pay, it gets published. Who decides, and on what facts? | A named decision owner who calls counsel, the breach coach and the insurer first |
| Board | If we did pay, how would the money move, and who would check who receives it? | Sanctions screening and a process run through advisers, never a direct transfer |
Is it illegal to pay a ransom in Canada?
No law bans it outright. The Cyber Centre warns it may be unlawful under laws against terrorism, money laundering, funding criminal organizations or sanctions, depending on who receives the money. Take legal advice and have the recipient screened before any payment is made.
Will our cyber insurance pay the ransom?
Check the cyber extortion section of your policy. Policies can set conditions, such as the insurer's consent, before a payment is covered. Call your insurer or breach coach before you decide anything, not after.
If we pay, will they delete the stolen data?
There is no way to know. The Cyber Centre lists copying, leaking or selling your data among the things attackers may still do after payment. Paying for deletion does not end your obligations to the people whose information was taken.
Who should decide whether to pay?
Someone named in advance, usually the CEO with board authority, advised by counsel, the breach coach and the insurer. What matters is that the room knows who signs, what they need to know first, and how the payment would even be made.