HIPAA Compliance News
Healthcare Data Breaches
IT Security Alerts
HIPAA Laws
HIPAA History
What is HIPAA Compliance?
GDPR Compliance News
GDPR Security Regulations
GDPR Data Retention
Spam News
How to Select Anti-Spam Software
Email Spam Tips
Cloud-Based Spam Filtering
Spam Filtering for Business
Cloud Security News
Cloud Security Risks
Cloud Security Best Practices
Cloud Security Governance
Sanctions and Penalties Could be Imposed for Paying Ransomware Payments
Home » Cybersecurity Alerts » Sanctions and Penalties Could be Imposed for Paying Ransomware Payments
Posted By NetSec Editor on Oct 5, 2020 |
Following a ransomware attack, many firms choose to pay the ransom demand to obtain the keys to decrypt files and prevent the sale or publication of data stolen in the attack. Many choose to use third party companies to negotiate with the attackers and pay the ransom. Payment of the ransom is not recommended by the FBI, as there is no guarantee that valid keys to decrypt files will be provided and payment of a ransom encourages threat actors to conduct further attacks. However, in some cases, payment of the ransom is the only option when it is not possible to recover data by any other means.
Last week, the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) issued an advisory, warning that in some cases, payment of a ransom could result in sanctions and penalties for the entity that pays the ransom.
"Companies that facilitate ransomware payments to cyber actors on behalf of victims, including financial institutions, cyber insurance firms, and companies involved in digital forensics and incident response, not only encourage future ransomware payment demands but also may risk violating OFAC regulations," said OFAC.
"OFAC may impose civil penalties for sanctions violations based on strict liability, meaning that a person subject to U.S. jurisdiction may be held civilly liable even if it did not know or have reason to know it was engaging in a transaction with a person that is prohibited under sanctions laws and regulations administered by OFAC."
OFAC has sanctioned some threat actors over the use of ransomware on U.S. organizations. For instance, the developer of Cryptolocker ransomware, two Iranians who provided support to SamSam ransomware, Evil Corp which is behind Dridex malware and WastedLocker ransomware, and the Lazarus group, which was involved in the May 2017 WannaCry 2.0 ransomware attacks.
Many threat actors have ties to foreign governments, which have led to sanctions. For instance, the Lazarus group operates on behalf of the North Korean government. Any payment of a ransom to one of the groups that have been sanctioned carries OFAC sanctions risks. OFAC explained that paying a ransom to any sanctioned entity could see the profits from the attacks used to advance their cause and could fund further malicious activities which threaten national interests.
"Additionally, any transaction that causes a violation under IEEPA, including transactions by a non-U.S. person which causes a U.S. person to violate any IEEPA-based sanctions, is also prohibited, U.S. persons, wherever located, are also generally prohibited from facilitating actions of non-U.S. persons, which could not be directly performed by U.S. persons due to U.S. sanctions regulations," explained OFAC.
In the event of a ransomware attack, victims and firms engaged by victims to contact the attackers should first contact OFAC to find out if the threat actors have been sanctioned, and they can them make an informed decision on the best course of action.
"Under OFAC's Enforcement Guidelines, OFAC will also consider a company's self-initiated, timely, and complete report of a ransomware attack to law enforcement to be a significant mitigating factor in determining an appropriate enforcement outcome if the situation is later determined to have a sanctions nexus," OFAC explained.
Author: NetSec Editor
Hackers Altered Stolen Pfizer Vaccine Documentation Prior to Publication
Cloud and Medical Device Security are the Top Challenges for Healthcare IT Teams
More Stringent Application of HIPAA Right of Access Rules by OCR Results in $200,000 Penalty
Healthcare Sector Cyberattacks Have Increased by 45% in the Past 2 Months
Hackers Behind European Medicines Agency Cyberattack Publish Stolen COVID-19 Vaccine Data
Receive security news directly via email
Confidentiality Guaranteed
Email address never shared, unsubscribe any time
Tweets by Net_Sec_News
About NetSec.News
NetSec.news is dedicated to helping IT professionals protect their networked environments, both from internal and external threats. Our goal is to provide the most comprehensive coverage of healthcare-related news anywhere online, in addition to independent advice about compliance and best practices to adopt to prevent data breaches.
Copyright © 2015-2021 NetSec.News About