Call us now:
A lot is being talked about recently of cyber incident response and paying ransomware fines. From past experience I can say that when you are in the middle of a cyber attack, the last thing you were initially thinking about was shall I pay the ransomware. The primary focus was resilience and getting the business back up and running, with the least amount of fallout. Paying a ransomware was seen as the last resort.
The problem with paying a ransom is simple, in most jurisdictions it can be considered morally reprehensible at best and at worst in breach of financial regulations. It’s also a very complex decision to make. For example under U.S Department of Treasury(DoT) rules U.S. persons must comply with OFAC regulations, that includes all U.S. citizens and permanent residents, all persons and entities within the United States, all U.S. incorporated entities and their foreign branches. This in effect means that U.S banks and insurers must comply, and if the payments are in U.S crypto you may have to consider the implications of making a payment. This was recently highlighted by a $53M fine by the DoT against Bittrex for failing to comply with OFAC and multiple sanctions programs. (https://lnkd.in/eGzy_HUZ.)
UK business’s should also consider the recent announcement between OFSI rules.
First port of call, speak with General Counsel.
Ted Dziekanowski
#cybersecurity #ofac #cyberriskmanagement #cyberlaw #theaugustagroup
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6996389489963102208