Double Victimization: Firms Paying Cyber Ransom Could Face U.S. Penalties

Ransomware on the Rise

In a ransomware attack, hackers use software to block access to the victim's own data and demand payment (usually in Bitcoin or another cryptocurrency) to regain access. It has been a growing problem in recent years, and such attacks have intensified since the COVID-19 pandemic has led to many people working from home for the first time.

Sanctioned Entities

The OFAC advisory specifically targets transactions benefiting individuals or entities on OFAC's Specially Designated Nationals and Blocked Persons List, other blocked persons, and those covered by comprehensive country or region embargoes (e.g., Cuba, the Crimea region of Ukraine, Iran, North Korea, and Syria). If you pay ransom to anyone in these categories, you could be fined or even jailed for breaching the International Emergency Economic Powers Act (IEEPA) or the Trading with the Enemy Act (TWEA). Penalties can vary widely, depending on the circumstances.

How is a Business Owner to Know?

“Companies should rely on experts to assist with their due diligence and work with the FBI,” writes law firm BakerHostetler in a recent blog post. “Experience in incident response is key, and your counsel should be an informed, confident partner as you navigate this rapidly evolving area.” Before a payment is made, the law firm writes, “a company generally retains a third party to conduct due diligence to ensure that the payment isn’t being made to a sanctioned organization or a group reasonably suspected of being tied to a sanctioned organization. Additionally, checks are in place to ensure that anti-money laundering laws are not being violated.”