UK to ban ransomware payments by public sector organizations

The UK government plans to prohibit public sector and critical national infrastructure from paying ransomware demands under a forthcoming Cyber Resilience Bill that strengthens NIS regulations, broadens regulatory scope (including datacenters and MSPs), and empowers authorities to mandate security improvements. Noncompliance—such as failing to patch widely exploited vulnerabilities leading to a breach—could incur fines up to £100,000 per day or 10% of turnover. The proposals also require mandatory reporting of intended ransom payments and warn organizations about sanctions risks, with guidance emphasizing robust backups and operational resilience.