First 72 hours after ransomware: the OFAC payment question and who to call
Quick answer, Oct 29, 2026As of 29 October 2026, the first 72 hours of a ransomware incident are four jobs run in parallel: contain and preserve, call insurance and counsel, report to the government, and settle the sanctions question before any payment is considered. OFAC treats a payment to a sanctioned actor as a sanctions risk even if the facilitator did not know.
Four jobs, in parallel
| Window | Job | Who |
|---|---|---|
| Hours 0–4 | Contain and preserve: isolate affected systems, preserve memory and logs, do not wipe. | IT or incident-response firm on retainer |
| Hours 0–8 | Notify your cyber insurer and outside counsel. Open the attorney-client privileged channel. | General counsel |
| Hours 2–24 | Report to the FBI (IC3 or your local FBI field office) and to CISA at stopransomware.gov. | CISO or incident lead |
| Hours 0–72 | Settle the sanctions question. Screen the ransomware strain, the wallet, any intermediary and any claimed broker against OFAC lists before anyone considers payment. | Counsel + sanctions advisor |
The sanctions question, as OFAC frames it
OFAC's Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (21 September 2021) is the current framework. The advisory sets out that OFAC enforces US sanctions on a strict liability basis: a US person who facilitates a payment to a sanctioned ransomware actor may be liable whether or not they knew the actor was sanctioned. The advisory lists the mitigating factors OFAC considers in an enforcement response, including whether the victim reported to law enforcement, cooperated with CISA, implemented meaningful compliance controls, and the quality of its due diligence on the payment.
A payment made to a strain, wallet or intermediary that OFAC later links to a designated person is a sanctions matter even if the payer did not know. That is the risk the ransomware advisory assigns to the facilitator, which can include the victim's counsel, insurer, IR firm or payments processor.
Who to call, and what each does
- FBI (IC3 and the local field office): the US government law-enforcement reporting channel. Reporting is a factor OFAC credits.
- CISA at stopransomware.gov: technical assistance and the #StopRansomware Guide (CISA, FBI, NSA and MS-ISAC).
- Cyber insurer and the breach coach on your policy: they coordinate IR, counsel and any payment. Check your policy's cooperation and consent-to-pay clauses before the first call.
- Outside counsel: privilege, breach-notification analysis under state laws and SEC Item 1.05 analysis for public companies (see SEC 8-K Item 1.05 cybersecurity incident disclosures).
- Sanctions advisor: screen the actor, strain, wallet and intermediary against the US lists.
Reading the sanctions picture before payment is discussed
- Named actor or group. Compare the group's name, aliases and known indicators to OFAC's SDN List and the Consolidated Screening List. Groups like Evil Corp (OFAC-designated December 2019) are on the record.
- Wallet. Compare any payment wallet to OFAC's digital-currency address listings. OFAC publishes these on the SDN, but the agency has stated that its wallet listings are not exhaustive. See Checking a crypto wallet or exchange for sanctions exposure.
- Intermediaries. Any broker or exchange involved is a separate screening job and a separate 50 Percent Rule check.
search_screening_lists and list_ofac_actions on the Distributed Risk MCP server let an AI assistant run those checks against the official US record, with the lists' last-change dates in the answer.
When the decision needs people on the ground
Where the incident has a physical, extortion or travel-safety dimension — threats to executives, data posted to a leak site, or operations in a country where the record is thin — brief an advisor and we arrange a crisis-response firm, an investigator or protective coverage with partners who work there.
Questions
Is a ransomware payment ever legal? The question is not legal-versus-illegal in the abstract: it is whether the payment flows to a sanctioned party. Where the party is designated, a payment is a sanctions matter. Where it is not, counsel and the insurer weigh business, legal and insurance considerations.
Does reporting to the FBI protect me? No, but OFAC's advisory treats law-enforcement reporting and cooperation as mitigating factors in any enforcement response.
Is this legal advice? No. This page is a procedural checklist. Counsel and your insurer decide what applies to your incident.