Pay At Your Own Risk: OFAC Issues Advisory On Potential Sanctions Risks Stemming From Ransomware Payments

On Thursday, October 1, 2020, the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC") issued an advisory highlighting potential sanctions risks associated with ransomware payments related to malicious cyber-enabled activities (the "Advisory").¹ The Advisory appears to be directed at both companies victimized by ransomware and firms that facilitate payments to ransomware extortionists (including financial institutions, cyber insurers, and companies involved in digital forensics and incident response). The Advisory cautions victims of ransomware attacks and ransomware-related services providers to consider the risk of civil sanctions liability when deciding on a course of action.