Falling victim to a ransomware attack is a shocking moment. This report puts the reader in the shoes of a victim, as they make difficult decisions in the ensuing days, and draws lessons for industry and policy-makers trying to grapple with this policy challenge.