Ransomware Insurance in the US: OFAC Rules & Coverage Denials

US ransomware insurance: OFAC compliance changes everything

American cyber insurance policies cover ransomware, but with a critical caveat: if you pay a ransom to a sanctioned entity on the OFAC SDN (Specially Designated Nationals) list, your claim will be denied as illegal. The Office of Foreign Assets Control maintains lists of individuals and organisations subject to US sanctions, primarily related to state-sponsored cyber attacks (Russia, North Korea, Iran). Most major ransomware groups are now OFAC-listed.

The FBI, CISA, and US Treasury actively discourage ransom payments. Since 2020, the US has treated ransomware payments to sanctioned actors as a violation of federal law. Your insurer will verify the threat actor's identity before paying any claim.

• OFAC verification is mandatory. Before any ransom negotiation or payment, you must verify the threat actor is not on the OFAC SDN list. Use the search tool at ofac-sdn.com or contact your insurer's IR team.
• Ransom payments to non-sanctioned actors. If the threat actor is NOT sanctioned, ransom payment coverage is typically available, but insurers now discourage it. The FBI reports 80% of paying victims are re-attacked within 12 months.
• Business interruption coverage. Covers lost revenue during downtime. US policies typically have 8–24 hour waiting periods; shorter waiting periods attract higher premiums.
• Incident response and forensics. Covered regardless of ransom decision. This includes investigation, threat actor negotiation (if pursued), and recovery specialists.

US law enforcement guidance on ransom payments

The FBI's official position is clear: do not pay ransoms. Payments fund criminal enterprises, incentivise future attacks, and provide no guarantee of data deletion. The US Treasury has issued multiple advisories warning organisations of the financial and reputational consequences of ransom payments.

CISA publishes detailed post-incident guidance for every major ransomware variant (LockBit, BlackCat, etc.), including recovery procedures without ransom payment. Many healthcare providers and critical infrastructure operators have successfully recovered using backups and incident response teams without payment.

What voids US ransomware coverage

US insurers have become aggressive about claim denials. These are the top reasons claims fail:

• No multi-factor authentication (MFA). The #1 denial reason. If you lack MFA on email, VPN, RDP, and admin portals, coverage is often denied outright or with significant sub-limits ($100K instead of $1M).
• OFAC violation. Paying a sanctioned entity automatically voids coverage.
• Failure to report within 72 hours. Many states (especially New York) require incident notification within 72 hours. Late reporting can void claims.
• Not using insurer's IR panel. Some policies mandate using the insurer's approved incident response firm. Using a different firm may result in partial or full denial.
• End-of-life operating systems. Windows 7, Server 2008, or other unsupported OS in your environment = coverage denial.
• No immutable or offline backups. If all backups are accessible from your network (attackers can delete them), coverage may be denied.

Recent US ransomware incidents

US ransomware statistics 2025–2026

How to ensure coverage in the US

• Deploy MFA on everything. Email, VPN, RDP, cloud admin portals, SaaS apps. This is non-negotiable for US insurers.
• Maintain offline/immutable backups. At least one backup must be air-gapped (not connected to your network) or immutable (attackers cannot modify or delete it).
• Verify OFAC compliance procedures. Have a documented process for checking threat actor identities against OFAC lists before any negotiation or payment.
• Understand your state's notification requirements. In New York, notification is required within 72 hours of discovery. Failure voids claims. Know your state's rules.
• Document incident response plan. Write and test a plan. Your insurer will ask for this if a claim occurs.
• Check ransomware sub-limits. Your $5M policy may have a $500K–$1M sub-limit for ransomware. Ask your broker for the exact number.
• Verify incident response panel. Ask if your insurer mandates using their IR team. If so, get those contact details in advance.