/find@mail

Articles, write-ups, and musings concerning the world of cybersecurity and technology.

To Pay or Not to Pay: Ethical Decision-Making in a Hospital Ransomware Attack

Simulated Case Studies  · 2,125 words · 11 min read · by QiO:~$ ·

To Pay or Not to Pay: Ethical Decision-Making in a Hospital Ransomware Attack

Disclosure: The hospital, board, and boardroom debate in this post are a hypothetical scenario given as an example. No real organization is described in the scenario itself; however the real-world incidents near the end are documented and sourced.

When ransomware locks up a hospital, the hardest question isn't technical. It's whether to pay the people who did it.

Ransomware is a type of malware that typically encrypts its victim's data and demands payment, usually in cryptocurrency, for a decryption key. In the cybersecurity field, ransomware raises ethical questions surrounding the payment of ransom to attackers. Such payments help fund further crime and victimization, yet in many circumstances may be the only way for an organization to minimize immediate harm. Choosing not to pay upholds principles against extortion but may come at the cost of short-term harms.

The Scenario

A mid-sized hospital in a rural area is hit with a ransomware attack. Suddenly, all of its patient data, scheduling systems, and payment processing information has been encrypted. Operations at the hospital may soon grind to a halt. Without accurate electronic charting information, doctors and nurses must scramble to employ paper charts in an attempt to keep patient care moving, though care has already been delayed. The IT staff have a notification on their screens demanding a payment of $5 million in Bitcoin for the keys to decrypt hospital data. In the C-suite, tensions are high, and finger-pointing has begun. Although the hospital has a cyber insurance policy, the board voted last year to exclude ransomware coverage as a cost-saving measure.

At the heart of the discussion in the boardroom is the ethical dilemma of whether or not the hospital ought to pay the ransom. Some members argue that paying the ransom may save lives and quickly resolve further organizational harm, but it would do so at the ethical risk of perpetuating further criminal extortion. The CISO takes the opportunity to point out that the data suggests victims who pay are more likely to be attacked again, because the attackers now know they will pay. Those in the room who are in favor of paying point out the ethical duty to protect patients from harm, as well as the catastrophic financial harms to stakeholders, loss of reputation, and potential legal exposure to lawsuits and regulatory violations.

Who Has a Stake

Stakeholders in this scenario include:

  • Patients, who are suffering delayed care and a potential breach of their privacy (HIPAA).
  • Hospital staff, who are experiencing increased workload, moral distress, and uncertainty.
  • Hospital administration, who have to make ethical decisions under pressure and under the weight of legal and financial responsibility.
  • Broader society, because the hospital receives tax dollars and payments in the form of Medicaid and Medicare.
  • Law enforcement, because payments undermine their efforts to combat ransomware and cybercrime.
  • The criminals themselves, who seek financial gain and funding for future extortion attacks.

It is easy to see how a ransomware attack can quickly paint an organization into an ethical corner. This situation is exactly why cybersecurity experts warn that proactive prevention, and backing up important data, is much more preferable to splitting ethical hairs under the immense pressure of a multi-million dollar ransom after falling victim to an attack. Nevertheless, a successful attack has occurred. How can an organization weigh the consequences of its decisions to make the most appropriate ethical choice?

Weighing the Options

Looking at the decision to pay the ransom, the positives are evident, assuming the attackers honor their word. Paying allows for quick recovery, minimizes patient and stakeholder harms, and allows operations to resume. However, this solution comes at the expense of funding organized crime and future ransomware extortion. There is also a real risk that attackers will choose not to honor the deal, and in some cases may even attempt a second extortion for more money. There are potential sanctions violations to consider as well: the U.S. Treasury's OFAC has made clear that it may impose civil penalties on a strict liability basis, meaning a company can be penalized even if it didn't know the recipient was sanctioned. Add regulatory scrutiny and the potential for increased attacks in the future.

When considering not to pay, the positives include denying funding for future criminal extortion and organized crime. It also aligns with guidance from government organizations like CISA that advise against making payments to criminal groups, and with OFAC's statement that the U.S. government "strongly discourages all private companies and citizens from paying ransom or extortion demands." That said, denying payment almost certainly results in prolonged downtime, enhanced patient safety risks, data leaks, and expensive incident recovery costs, as well as potential lawsuits and loss of public trust.

A scenario such as this one illustrates that many times in life and business, there are no objectively right or wrong answers. Each decision can have both positive and negative impact on stakeholders. When evaluating which decision to make, there are ethical principles to consider. Each decision must be weighed against these principles in order to establish the most ethical course of action available to the hospital, the one that does the least harm to stakeholders. The goal is to find the best solution out of two unfortunate choices.

Five Lenses

Ethical decision-making in a ransomware dilemma requires balancing different philosophical and professional frameworks. No single principle provides a simple answer, yet when considered together, they can shed light on the ethical tensions and provide guidance toward an ethical outcome.

Utilitarianism evaluates actions based on their outcomes and is typically focused on the greatest good for the greatest number. In this scenario, paying the ransom could result in the greatest immediate utility by restoring operations quickly and minimizing patient harm and disruption. However, the long-term (and unintended) consequences weigh heavily against payment. Each ransom paid serves to strengthen and encourage criminal activity, even encouraging future attacks against other hospitals. Ultimately, this has the potential to harm more people across society than those immediately affected. The utilitarian view forces a choice between short-term results and long-term consequences, preferring the result that does the most good for the most people, which is almost impossible to quantify accurately.

Deontological ethics emphasizes duties, rules, and moral absolutes without regard to outcome. From this perspective, there is a clear duty not to fund criminal enterprises or encourage extortion. Deontology also holds that paying a ransom makes the hospital complicit in future illegal activity, violating principles of honesty and integrity. Often, religious or scriptural worldviews align closely with this kind of duty-based ethic and its refusal to participate in immoral activity, even under duress. Deontology in this scenario would hold that the hospital has a moral obligation to refuse payment on grounds of duty and principle alone.

Virtue ethics focuses less on rules, duties, and outcomes, and instead looks at the character of the decision makers. Each individual who votes on a response, or perhaps a CEO making an executive decision, must evaluate his or her own personal virtue. Does the individual avoid panic-driven decisions? Does the individual prefer fast results over long-term gain? Is the individual wise and forward-thinking? Virtues such as courage, temperance, and prudence come into play and, whether spoken or unspoken, will affect the outcome of the decision.

Justice raises questions of fairness. Is it just to protect current patients at the possible expense of future victims at the hands of cybercriminals, flush with funds from this ransom payment? Paying may solve the immediate hardship at hand, but it shifts the potential burden to other vulnerable people. One institution's short-term solution can become a long-term problem for society.

Professional ethics and legal principles must also be considered. Cybersecurity organizations such as ISC2, ISACA, and EC-Council have codes of ethics that emphasize the prioritization of public safety, due diligence, and responsible stewardship of information systems. Cybersecurity professionals are duty-bound to advocate for strong security measures and resilient architectures rather than reactive ransom payments. Legal principles add another layer. While making ransomware payments in the United States is generally not illegal in itself, organizations may run afoul of anti-money laundering laws or sanctions regulations if payments are traced to designated terrorist groups or sanctioned entities. Regulators may also scrutinize the hospital's due care in prevention and in the decisions leading up to a payment.

What Real Hospitals Faced

The hypothetical hospital isn't far from reality, and real cases show how the trade-offs play out.

When Change Healthcare was hit in February 2024, its parent company UnitedHealth Group paid the BlackCat (ALPHV) gang $22 million in Bitcoin. It didn't get its data back: a BlackCat affiliate called RansomHub leaked the stolen data and attempted a second extortion, and losses went past $1 billion.

When Ireland's Health Service Executive was hit by Conti in 2021, recovery took nearly five months and initial cost estimates reached $600 million, including $120 million in direct recovery expenses. Staff fell back on manual processes. The attackers eventually released a decryption key after media attention. Notably, the post-incident report found there were several detections of the attacker's activity before the ransomware was deployed that never became a security incident, so the failure started long before the ransom note.

Payment trends point the same direction. Chainalysis data reported by The Record shows the share of victims paying fell to a historic low of 28% in 2025, even as claimed attacks surged about 50%, with researchers noting that paying "rarely bodes well for victims."

My Position

Personally speaking, my values align closely with the cybersecurity ethical guidance to advocate for, and ensure, strong prevention and stewardship, so that a decision about ransomware payment becomes moot. However, in the scenario above, our participants are beyond this point, and although the decision is difficult considering the implications, I would feel guided deontologically to refuse such a payment. On religious ethical grounds, I would also object to payment because of the possibility of being an indirect party to further extortion, in light of 1 Corinthians 6:10, which lists extortioners among those who shall not inherit the kingdom of God (King James Bible).

After carefully weighing the ethical considerations involved, businesses such as the hospital in this scenario should face the unfortunate challenge of a ransomware attack head-on, refusing to shift blame, refusing to delay consequence, and denying the payment of a ransom. It is, in my opinion, ethically dubious to pay millions of dollars to organized crime, which will likely place others in a similar situation and may fund even worse enterprises. An organization that failed to prepare must accept both the responsibility and the consequences of resolving the situation without perpetuating ransomware extortion.

Organizations should determine that, although they have fallen victim to such a crime, they will overcome the challenge and shoulder their responsibility. This approach turns a negative situation into a positive learning experience. Law enforcement and government agencies like CISA should be involved immediately to aid in investigation and recovery, especially in light of electronic health data and HIPAA regulations. (OFAC also treats prompt, complete reporting and ongoing cooperation with law enforcement as significant mitigating factors if a sanctions question ever comes up.) The organization should document every step of its recovery process, even if it takes weeks, and a group should be formed to gather as much documentation, interviews, and general information as they can during this process. Malware samples should be collected and analyzed, or turned over to the relevant authorities for analysis and investigation.

The Takeaway

Once the smoke clears, all of the information gathered through documentation and cooperation with authorities should be used to develop internal policies and technical processes that both strengthen prevention of another ransomware incident and provide actionable guidance in the event one is successful in the future. The risk cannot be shifted ethically, or the proverbial can "kicked down the road." Stakeholders must accept the immediate consequences of failure, weigh the ethical ramifications, and resolve that this time they may have been victimized, and it will be the last.

And the best time to decide whether to pay is long before the ransom note appears. A policy written calmly in advance, with the board, legal, and incident response in the same room, beats an argument held at 3 a.m. with the charts offline.

Sources

Read next

Infographic: Ethical Implications of A.I. in Cyber Security