Abstract
<jats:p>This study uses data from online moderated interviews with 33 ransomware victims to examine victim decision-making during a ransomware attack. While ransomware attacks could be a fear-inducing and stressful experience, victims logically assessed the threat and weighed up their responses. Victims commonly found practical ways to restore their data and systems, often with advice and support from trusted sources. Victims rarely tried to negotiate with offenders. The vast majority of victims decided against paying the ransom because they distrusted the offenders. Victims are capable of rational decision-making following ransomware attacks even during periods of heightened stress and emotion. Support and resources to help victims assess the risks associated with a ransomware attack and to restore their data and devices must be readily accessible when ransomware attacks occur.</jats:p>