Paying Ransomware Demands May Violate Sanctions, US Treasury Warns

US officials have issued a stark warning to financial institutions and insurers who have paid hackers following cyberattacks.

In recent years – despite clear advice from security professionals – there has been a spate of payouts to cybercriminals following ransomware attacks, as well as payouts to stop hackers targeting particular businesses, or for them to delete sensitive data stolen in an attack.

But now the US Treasury Department has official warned insurers or anyone else paying these online criminals, they could well be violating US sanction rules, Reuters reported.

Sanction warning

The warnings came in advisories from the US Treasury’s Office of Foreign Assets Control (OFAC) and Financial Crimes Enforcement Network (FinCEN).

It specifically mentions ransomware, which typically cripples a victims computer network by infecting and encrypting it, and demanding a ransom (typically paid in cryptocurrency) in return for an encryption key to unlock systems.

OFAC reportedly cited cyberattacks dating to 2015 that were traced to hackers in North Korea and Russia, both countries that have US sanctions against them.

FinCEN has also warned to a growing industry of forensics firms that help organisations respond to cyberattacks, including processing the payment.

The United States can impose economic and trade sanctions on countries that sponsor terrorism or violate human rights, Reuters reported.

This means that financial institutions that engage with them or some individuals can face prosecution and penalties.

Hacker payouts

And there is a very good reason the US Treasury’s Office has issued these warnings, in light of the current circumstances.

Recent ransomware attacks have targeted hospitals with devastating effects (including deaths), but these attacks have also crippled factories, companies, and even whole cities.

In the US alone, 764 healthcare providers were hit by ransomware last year, according to data compiled by Emsisoft.

And despite advice against it, some of these institutions opt to pay the hackers.

In July for example, fitness and navigation specialist Garmin admitted that it was the victim of a ransomware attack, after first reporting an “outage”.

Media reports at the time suggested Garmin had “obtained the decryption key” to recover its computer files, but the firm “did not directly make a payment to the hackers.”

This meant that Garmin may have made a payment via a third party, but if that is the case, the company risked violating US Treasury sanctions against the Russian hackers Evil Corp.

In June this year, the city of Keizer (in Oregon) reportedly paid a ransom of $48,000 to regain control of its computer system after a ransomware attack.

In January of this year, a ransom of $300,000 was paid by Tillamook County (in Oregon) to recover systems following a ransomware attack.

Last year Lake City (in Florida) opted to pay hackers after a ransomware attack. They paid a staggering $500,000 (£394,000), most of which covered by an insurance policy.

Another city – Riviera Beach City (also in Florida) – also voted unanimously to pay hackers $600,000 who took over their computer systems via a ransomware attackin 2019.

US warning

But will the clear warning from the US Treasury’s Office actually halt these payouts to hackers?

Well, it will add another layer of concern for cyber insurers, who have been ramping up rates and trying to curb exposure to vulnerable customers because of surging costly ransomware claims in recent years, Reuters reported.

The average ransomware payment reportedly jumped by 60 percent to $178,254 between the first and second quarters, according to Coveware (a firm that reportedly helps negotiate and facilitate cyber ransom payments).

Sophisticated insurers and financial institutions are already aware of the sanctions concern, Sumon Dantiki, a King & Spalding LLC lawyer who advises on national security and cyber matters told Reuters.

“Will victims who are insured still decide to make the payments?” Dantiki said. “This type of public advisory could affect the calculus there.”

Tom Jowitt

Tom Jowitt is a leading British tech freelancer and long standing contributor to Silicon UK. He is also a bit of a Lord of the Rings nut...

Recent Posts

Tesla Reaches $1 Trillion Valuation

Car maker Tesla now worth at least double that of Toyota, Volkswagen and Ford combined,…

19 hours ago

Australia Funds Telstra Buy Of Digicel Pacific To Thwart China

Strategic blocking? Australian government joins forces with Telstra to acquire Digicel Pacific, after interest from…

19 hours ago

Apple ‘Very Likely’ To Face DoJ Antitrust Lawsuit – Report

Two year investigation by Department of Justice of tech giants has seen acceleration of Apple…

21 hours ago

France Holds Secret Talks With Israel Over NSO Spyware

Top adviser to French President holds talks with Israeli counterpart to discuss NSO spyware allegedly…

21 hours ago

Facebook Making Online Hate Worse, Whistleblower Tells MPs

Frances Haugen answered questions from the UK parliament's Joint Committee on Monday, after cache of…

23 hours ago