Treasury To Companies: Time To Take Ransomware Reporting Seriously

On September 21, 2021, the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) published an updated sanctions advisory, providing guidance to companies on sanctions compliance obligations related to ransomware payments. The bottom line: cyberattack victims should focus on defense and mitigation measures over a policy of paying out ransoms.¹

The Updated Advisory on Potential Risks for Facilitating Ransomware Payments updates OFAC's prior guidance issued in October 2020. The new advisory reemphasizes self-reporting and highlights risks inherent in ransomware payments, while adding discussion of mitigating factors in enforcement actions. When self-reporting to OFAC, companies should note that agency officials will want as much detail as can be shared, including not just the victims and systems affected, but also how long the attacker was in those systems, the firms involved in the recovery, timeline of the attack, ransom amounts and ransomer information.