UK Expands Ransomware Payment Ban to Public Sector, Mandates 72-Hour Reporting After 75% Public Support

The UK government is advancing a comprehensive ban on ransomware payments across its public sector and critical national infrastructure, aiming to dismantle the financial incentives driving cybercriminal operations. This policy expansion extends existing restrictions beyond government departments to include health services, local councils, and energy providers, addressing growing concerns over ransomware’s disruption of essential public services. Security Minister Dan Jarvis emphasized the Home Office’s goal to “smash the cyber criminal business model” through collaboration with industry stakeholders and the implementation of mandatory reporting and prevention measures.

The proposed legislation, informed by a public consultation between January and April 2024, reflects strong support for the initiative, with 75% of respondents backing the ban. The expansion seeks to protect critical infrastructure from ransomware attacks, which typically demand cryptocurrency payments to unlock encrypted systems. A mandatory reporting framework will require victims to submit detailed incident reports within 72 hours, followed by a 28-day analysis to improve transparency and response strategies. This approach aims to strengthen cybersecurity resilience while deterring attackers reliant on financial rewards.

Consultation responses highlighted divisions over enforcement mechanisms, particularly penalties for non-compliance. While most supported the ban, concerns were raised about criminalizing victims. The government acknowledged these concerns, committing to explore balanced strategies that deter ransom payments without disproportionately penalizing affected organizations. Additionally, there was interest in broadening the prevention regime to cover all sectors, underscoring the pervasive nature of the threat. A threshold-based reporting system was favored over voluntary disclosures, emphasizing the need for standardized, timely information sharing.

Ransomware remains the UK’s most immediate cybersecurity threat, as outlined in the 2024 National Cyber Security Centre (NCSC) Annual Review. High-profile incidents, such as the June 2024 attack on pathology laboratory Synnovis and the October 2023 breach of the British Library’s systems, have demonstrated the operational and reputational damage such attacks can inflict. The British Library’s chief executive noted the destruction of its technological infrastructure and the disruption to users accessing one of the world’s largest knowledge collections. These incidents underscore the urgency of regulatory action to mitigate risks to critical services.

Global approaches to ransomware vary, with the UK’s proactive stance contrasting with other nations’ strategies. The U.S. faces political resistance to mandatory cyber incident disclosures, while Australia has implemented mandatory reporting laws for businesses exceeding specific revenue thresholds. Despite considering a ransomware payment ban after an attack on Latitude Financial, Australia ultimately rejected the proposal. These divergent approaches highlight the challenges governments face in balancing cybersecurity enforcement with economic and legal considerations.

The UK’s expanded ban and reporting requirements represent a significant step in disrupting cyber extortion schemes. By fostering collaboration between public and private sectors, the government aims to build a resilient digital infrastructure capable of withstanding evolving threats. Stakeholders are urged to adopt best practices and engage in ongoing consultations to align with forthcoming regulations. As ransomware tactics evolve, proactive measures like these will be critical in protecting public services and maintaining trust in digital systems.

This initiative reflects a decisive effort to undermine cybercriminal incentives while addressing enforcement challenges. The government’s focus on mandatory reporting and prevention regimes underscores its commitment to proactive cybersecurity governance. Coupled with international developments, the UK’s approach highlights the growing recognition that combating ransomware requires coordinated regulatory frameworks and industry partnerships to ensure long-term digital resilience.