Paying ransomware demands may breach international sanctions, US Treasury warns

Companies that agree to hand over cash to hackers to free their systems from ransomware may face prosecution or penalties, the US Treasury said on Thursday.

Advisories from both the Treasury's Office of Foreign Assets Control (OFAC) and its Financial Crimes Enforcement Network (FinCEN) have warned that many hacker groups are believed to be operating from countries under economic sanctions, as reported by Reuters.

Any companies engaging with groups inside these countries could be in breach of these sanctions, the advisories warned, even in those cases where the company was unaware of the hackers' location.

The OFAC's advisory cited cyber attacks that were linked to hacking groups from North Korea and Russia, which are both nations sanctioned by the US. The US government often imposes economic and trade sanctions on countries that it deems sponsors terrorism or that violate human rights.

These latest warnings from the OFAC and FinCEN show an intent to regulate a rapidly growing market of companies who help organisations pay off hackers, such as cyber insurance firms or security consultancies.

The Enforcement Network's advisory also warned that cyber security firms may need to register as 'money services' if they help make these ransomware payments. This would place a new requirement on a section of the cyber security industry that is rapidly growing.

An affected company's decision to pay a ransom is not necessarily illegal, though it is usually ill advised. A 2019 survey from AT&T Cybersecurity revealed that 40% of IT security professionals believe that there should be a law preventing firms from paying ransoms. The argument often centres on the problem of there being no guarantee that the hackers will fulfil their end of the bargain and return stolen data.