Ransomware And Sanctions Compliance: Considerations For Responses To Attacks

Last month, reports surfaced that fitness technology company Garmin may have made a multimillion dollar payment in response to a ransomware attack with reported links to Evil Corp, a Russian hacking group subject to U.S. sanctions. This incident and other recent reports of ransomware attacks against large companies highlights that companies should consider potential civil and criminal liability under U.S. sanctions laws when responding to ransomware attacks.

Ransomware Overview

As illustrated by recent attacks, cybercriminals have increasingly directed ransomware towards multinational companies with the expectation of large payouts. As a type of malicious software, ransomware typically infects a target indirectly through spear phishing attacks using fraudulent emails and websites, or directly through network vulnerabilities. Upon infection, the ransomware disables a victim's access to its computer data or systems and demands a ransom payment in order to recover