OFAC Updates Ransomware Advisory

In an updated advisory, OFAC underscored the sanctions risks arising from ransomware payments made in response to "malicious cyber-enabled activities." OFAC stated that ransomware attacks have spiked during the COVID-19 pandemic as a result of increased reliance on online systems for business operations.

OFAC warned companies of the following potential sanctions risks associated with ransomware payments:

• ransomware payments can be used by criminals with a sanctions nexus to support illegal operations, including activities that are harmful to U.S. national security or are in contravention to U.S. foreign policy objectives; and
• OFAC may hold civilly liable any individual who unknowingly makes a ransom payment in violation of the International Emergency Economic Powers Act or to an entity on the Specially Designated Nationals and Blocked Persons List ("SDN List").