Ransomware Payment Tabletop for City Councils

A ransomware payment tabletop lets a council rehearse a hard governance question before it is real: who can lawfully decide, on what evidence and within what limits. No official always decides, and there is no universal pay-or-do-not-pay answer. Authority depends on local law, charter, emergency powers, spending and procurement rules, insurance terms and the specific facts. Use this exercise to identify lawful decision authority before an incident. It is training material, not legal advice.

What the Bernalillo vote does and does not show

DataBreaches.net reported on November 2, 2026 that the Town of Bernalillo, New Mexico, council unanimously approved an $82,000 offer after a ransomware incident. The Paper reported the vote on October 27 and said next steps depended on whether the offer was accepted.

An approved offer is not proof that money was paid, that a decryptor was received, that data was deleted or that payment restored any system. The reports read for this page do not establish those outcomes. They also do not establish an attacker, entry vector, stolen-data volume, negotiation status, insurance decision or full restoration.

Treat the timeline with care. The Albuquerque Journal attributed a report time of about 5:15 a.m. on October 9 to the town's spokesperson, while KRQE said on October 15 that the IT director found the attack the previous weekend. Discovery, disruption and statement dates can differ, so check town records before relying on one.

Service reports also carry their own attribution. KRQE reported a closed motor vehicle office and unavailable online payments. The Paper reported that police and fire systems were unaffected apart from a brief body camera delay, and that water service continued. The Journal quoted a spokesperson saying "no data has been compromised to this point" in mid-October, and The Paper later reported the mayor's stated aim as protecting systems and employee and possibly customer information.

The vote is context, not a model for other municipalities. Everything after this section is fictional training material.

Who decides whether to pay a ransom?

It depends on local law, the charter, emergency powers and spending rules, so no single office holds that decision everywhere. In some states the option may not exist for a local government. Have the municipal attorney confirm current law before the exercise.

North Carolina G.S. 143-800 bars covered state agencies and local government entities from paying or otherwise communicating with the attacker, and Florida s. 282.3186 says a covered agency, county or municipality may not pay or otherwise comply with a ransom demand. Other states differ.

Does the FBI or CISA make the decision?

No. Federal agencies publish positions and receive reports, but they do not make the municipality's decision. Their positions still belong in the record.

The FBI's IC3 page says "The FBI does not support paying a ransom" and that payment does not guarantee any data comes back. The #StopRansomware Guide from CISA and partners also recommends against payment. A recent CISA advisory urges reporting whether or not the victim has decided to pay.

Does an OFAC check make a payment legal?

No. Screening is one input for counsel, not a yes-or-no answer, and a clean lookup does not guarantee legality. Sanctions compliance obligations apply independently of ransomware urgency.

OFAC's updated 2021 advisory warns about sanctions risks in facilitating payments, and Treasury's announcement says the government strongly discourages them. Crowell & Moring's summary describes strict-liability civil penalties, a licensing presumption of denial, and prompt reporting and cooperation as mitigating factors. A mitigating factor is not immunity. FinCEN's advisory adds that vendors who facilitate payments may have their own obligations, depending on the facts.

Does paying guarantee recovery?

No. Payment does not guarantee a working decryptor, complete restoration, deletion of copied data, silence or freedom from another demand. The exercise should keep those limits visible at every stage.

The 60-minute ransomware payment tabletop agenda

Invite the mayor, council members, manager, clerk, finance leader and municipal attorney, plus a facilitator and a note-taker. This page covers governing the payment decision. For technical response, run the staff-level ransomware tabletop first. For restoration order and manual continuity, use the municipal recovery priorities guide. A 45-minute version can cut each inject to about five minutes.

• 00:00 to 05:00: purpose, roles, no-blame rule and safety boundary.
• 05:00 to 12:00: inject 1, service outage.
• 12:00 to 20:00: inject 2, restoration options.
• 20:00 to 28:00: inject 3, demand and data claim.
• 28:00 to 37:00: inject 4, authority and counsel.
• 37:00 to 45:00: inject 5, outside parties.
• 45:00 to 53:00: inject 6, the decision meeting.
• 53:00 to 60:00: decision record and after-action owners.

Safety boundary: this is a discussion exercise only. Nobody contacts a threat actor, moves cryptocurrency, changes production systems or handles real sensitive incident evidence.

Fictional scenario and injects

The Town of Example is fictional and is not based on Bernalillo. The facilitator sets the demand figure and deadline in advance and labels both as invented.

Inject 1, outage. Billing, permitting and email are down. Which services remain operational, what resident safety risks exist, which manual workarounds are running, and what evidence supports the recovery priorities?

Inject 2, restoration. IT and outside responders brief the group. Is clean restoration feasible? When was the last tested backup, what is the estimated restoration range, and which critical dependencies could change it?

Inject 3, demand. A ransom note sets a deadline and alleges data theft. What evidence supports or contradicts that claim? Who may communicate about it, and who may not?

Inject 4, authority. The manager requests a special meeting. Who holds legal spending authority, who can declare an emergency, and is council action required? How do recusal, quorum, open-meeting, public-records, procurement and emergency-purchasing rules apply locally? What do the municipal attorney and breach or privacy counsel advise, what is privileged, and what must be documented publicly?

Inject 5, outside parties. What has been shared with law enforcement, CISA and the FBI? What does the policy require on insurer notice, consent, approved vendors, sublimits and exclusions? Do not assume coverage or reimbursement. Who performs sanctions review, and what can that review not establish?

Inject 6, decision meeting. Qualified responders report safely testing a sample decryptor. That shows the sample worked, not that a full recovery will. If an offer were authorized, who is the authorized negotiator, and which finance, custody and fraud-prevention controls apply? What are the consequences of delay for residents, and what will the public be told?

Questions the council should ask before voting

Whether a vote is required, and whether any discussion may be closed or confidential, must be resolved under state law, charter, policies and counsel. Use these in closed or open session as local law permits.

• Authority and legal limits: Is payment lawful here? Who may approve it, and under what procedure?
• Service impact and public safety: What is down, who is harmed and how soon?
• Restoration alternatives: What are the options and time ranges with and without payment?
• Evidence and uncertainty: What is confirmed, what is claimed and what is unknown?
• Law enforcement and sanctions: Who has been contacted, and who reviewed sanctions risk?
• Insurance and vendors: What does the insurer require, and what remains unconfirmed?
• Financial authority and controls: What is the funding source and who holds approval and custody?
• Data exposure and notification: What may have been copied, and which duties apply either way?
• Communications and records: What must be public, and who is the single spokesperson?
• Conditions and follow-through: What conditions and expiration apply, and who owns documentation and after-action work?

Sample decision record (fictional template)

• Meeting type, legal basis and members present, with any recusals.
• Decision requested and the authority relied on.
• Facts confirmed, facts claimed and open unknowns, each with a source.
• Advice received from counsel, insurer, law enforcement and responders, recorded as counsel directs.
• Options considered, including no payment and any legal bar on payment.
• Outcome, conditions, expiration and named owner.

After-action checklist

• Confirm in writing who holds authority and what state law allows.
• Update emergency, procurement and meeting procedures through counsel.
• Verify the insurer notice and consent steps, and keep contacts available offline.
• Test backups and record a realistic restoration range.
• Assign an owner and date to every gap, then schedule the next exercise.

Sources

• DataBreaches.net, Bernalillo offer report, November 2, 2026
• The Paper via nm.news, October 27, 2026
• Albuquerque Journal, October 15, 2026
• KRQE via Yahoo, October 15, 2026
• FBI IC3, Ransomware
• CISA and partners, #StopRansomware Guide
• CISA, AA26-293A
• OFAC, updated ransomware advisory notice, September 21, 2021
• Treasury press release JY0364
• FinCEN Advisory FIN-2021-A004
• North Carolina G.S. 143-800
• Florida Statutes s. 282.3186