Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

New York

Washington, D.C.

Ransomware attacks have been increasing, forcing many businesses to choose between paying a ransom and losing access to their confidential and proprietary data or information networks and systems. On September 21, the Department of the Treasury issued an&nbsp;<a href="https://home.treasury.gov/system/files/126/ofac_ransomware_advisory.pdf" target="_blank" rel="noopener">updated advisory</a> that highlights potential sanctions risks for companies that directly make or otherwise facilitate ransomware payments and offers “proactive steps” companies can take to mitigate such risks. The advisory updates guidance offered in October 2020, which highlighted that anti-money laundering and economic sanctions regulations implemented and enforced by Treasury’s Office of Terrorism and Financial Intelligence may be triggered by persons or companies involved in facilitating ransomware payments. In turn, organizations should consider this advisory, as well as other federal resources and guidance, when updating their data breach response plans and compliance programs.

contentpilot/introduction

core/heading

Ransomware attacks are increasing in size, sophistication and frequency. According to the FBI, there was “a nearly 21 percent increase in reported ransomware cases and a 225 percent increase in associated losses from 2019 to 2020.” In 2020 alone, ransomware payments totaled over $400 million. The financial harm caused by these attacks, however, is not limited to these payments, as the economic damage extends to the disruption of critical sectors, including financial services, health care and energy, as well as the exposure of confidential corporate and personal information.

core/paragraph

The Treasury Department’s advisory notes that companies “that facilitate ransomware payments to cyber actors on behalf of victims, including financial institutions, cyber insurance firms, and companies involved in digital forensics and incident response, not only encourage future ransomware payment demands but also may risk violating OFAC regulations.” Since 2013, Treasury’s Office of Foreign Assets Control (OFAC) has designated numerous malicious cyber actors under its <a href="https://home.treasury.gov/policy-issues/financial-sanctions/sanctions-programs-and-country-information/sanctions-related-to-significant-malicious-cyber-enabled-activities" target="_blank" rel="noopener">cyber-related sanctions program</a>. The advisory notes that OFAC will continue to impose sanctions on such actors “and others who materially assist, sponsor, or provide financial, material, or technological support for these activities,” as such support “may enable criminals and adversaries with a sanctions nexus to profit and advance their illicit aims.” The U.S. government discourages payment of any cyber ransom, as such payment may be to sanctioned persons or to comprehensively sanctioned jurisdictions where the funds could be used for activities adverse to U.S. national security.

The Treasury Department indicates that virtual currency exchanges are a critical element and the principal means of facilitating ransomware payments and associated money laundering activities. While most virtual currency activity is commercial and lawful, the process can be used for illicit activity through peer-to-peer exchangers, mixers and exchanges, including facilitating sanctions evasion, ransomware schemes and other cybercrimes. In conjunction with releasing Treasury’s updated advisory, OFAC announced the designation of virtual currency exchange SUEX OTC, S.R.O. (SUEX) for its part in facilitating financial transactions for certain malign ransomware actors. According to OFAC, SUEX has facilitated transactions involving illicit proceeds from at least eight cyberattacks and the resulting ransomware payments.

This is the first OFAC sanctions designation against a virtual currency exchange and, as a result, SUEX has been added to the <a href="https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20210921" target="_blank" rel="noopener">Specially Designated Nationals List</a>. As of September 21, all property and interests in property of SUEX that are in the United States or in the possession or control of U.S. persons are blocked and must be reported to OFAC. In addition, any entities that are owned, directly or indirectly, 50% or more by SUEX are also blocked. U.S. persons are generally prohibited from engaging in transactions with SUEX absent a specific license from OFAC.

The Treasury Department’s advisory reminds organizations that enforcement actions for violations of the federal government’s sanctions programs can range from non-public responses (e.g., No Action Letter or Cautionary Letter) to public responses (e.g., civil monetary penalties) and states that non-public responses are more likely when impacted parties undertake certain “mitigating steps,” such as reporting ransomware attacks to, and cooperating with, law enforcement. Although a comprehensive and effective sanctions compliance program is an important tool for mitigating exposure to sanctions-related violations, the advisory focuses on information sharing as another key aspect of mitigating risk. More specifically, the advisory references the Cybersecurity and Infrastructure Security Agency (CISA), FBI field offices, FBI Internet Crime Complaint Center and local U.S. Secret Service offices as the federal agencies and offices that organizations should engage and cooperate and share information with following a ransomware attack.

However, organizations should consider whether they can disclose data breach reports and other internal information to federal agencies in a manner that preserves certain privileges and protections. For instance, according to the Cybersecurity Information Sharing Act of 2015, providing cyber threat indicators and defensive measures to the federal government pursuant to certain federal information sharing programs will not constitute a waiver of any applicable privilege or protection provided by law, including trade secret protection. Accordingly, organizations should familiarize themselves with the federal government’s information sharing programs and build the most appropriate ones into their data breach response plans so they are better prepared to engage in such activities following a ransomware attack or other security event.

The Treasury Department’s advisory notes that organizations should adopt comprehensive information security measures and controls, such as those set forth in CISA’s <a href="https://www.cisa.gov/sites/default/files/publications/CISA_MS-ISAC_Ransomware Guide_S508C_.pdf" target="_blank" rel="noopener">September 2020 Ransomware Guide</a>. It also recommends that organizations implement security practices to better protect their information technology networks and systems, including:

core/list

Interestingly, the advisory comes only a few months after the White House published&nbsp;<a href="https://sbecouncil.org/wp-content/uploads/2021/06/Memo-What-We-Urge-You-To-Do-To-Protect-Against-The-Threat-of-Ransomware.pdf" target="_blank" rel="noopener">an open letter</a> to corporate executives and business leaders urging them to take similar proactive measures to defend against the recent increase in ransomware attacks. The letter and the advisory each reference additional resources and guidance that organizations can use to build a comprehensive data breach response plan and international trade compliance program.

Francesca M.S. Guerrero Partner, International Trade 202.973.2774 <a href="mailto:Francesca.Guerrero@ThompsonHine.com">Francesca.Guerrero@ThompsonHine.com</a>

Steven G. Stransky Partner, Business Litigation 216.566.5646 202.263.4126 <a href="mailto:Steve.Stransky@ThompsonHine.com">Steve.Stransky@ThompsonHine.com</a>

Samir D. Varma Partner, International Trade 202.263.4136 <a href="mailto:Samir.Varma@ThompsonHine.com">Samir.Varma@ThompsonHine.com</a>

Scott E. Diamond* Senior Legislative &amp; Regulatory Policy Advisor, International Trade 202.263.4197 <a href="mailto:Scott.Diamond@ThompsonHine.com">Scott.Diamond@ThompsonHine.com</a>

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2022/04/International_Trade_Update_-_Treasury_Department_Issues_Updated_Advisory_on_Ransomware_Payments.pdf

Treasury Department Issues Updated Advisory on Ransomware Payments

Services