Facilitating Ransomware Payments Entails Sanctions Risks, OFAC Warns

The Treasury Department's Office of Foreign Assets Control (OFAC) issued an advisory on October 1, 2020, warning companies that engage with the victims of ransomware attacks that they run the risk of violating U.S. sanctions by facilitating ransomware payments. Ransomware attacks have increased in number and sophistication in recent years and have netted larger and larger payments from victims seeking to regain access to their digital systems and files or to prevent the threatened release of private information. The OFAC advisory cites FBI reports showing an annual increase of 37% in ransomware attacks and 147% in related losses from 2018 to 2019, and observes that payment demands associated with ransomware attacks have increased since the COVID-19 pandemic has forced businesses into greater reliance on online systems.