Ransomware, a Designated Group, and the Agent Who Asked for a Delay
Lakeshore Regional Health operates 22 facilities in Ohio and Pennsylvania and is a HIPAA covered entity. On 2 February ransomware encrypted its electronic health record system; 41,000 patients' records were exfiltrated. The FBI attributes the intrusion to 'Blackglass,' a group added to the OFAC SDN list in 2023. The group demands $4.5 million in Monero within 96 hours. Lakeshore's cyber insurer authorizes up to $1.5 million for incident costs and requires pre-approval for any ransom payment. The incident-response firm proposes a sanctions-screening vendor and a third-party broker to negotiate. On 4 February an FBI agent tells the CEO by phone that notice to patients 'could tip off the group' and asks Lakeshore to hold off; the agent then sends a one-paragraph email saying 'we request a delay.' On 5 February the CEO tells the board: 'We'll pay, then notify patients well after the 60 days, since the FBI asked us to wait.'
1. Assess the sanctions exposure from paying the ransom and the steps that would reduce it.
Read the worked answer
Rule. OFAC administers US sanctions under IEEPA and related statutes. A US person may not deal in the property or interests in property of a specially designated national, including by providing any contribution of funds, goods or services to or for the benefit of a designated person; the 50 percent rule extends this to entities owned by designated persons. Civil liability is strict - the government need not prove knowledge. OFAC's 2021 Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments states that paying a designated actor risks enforcement and that OFAC will weigh a risk-based approach: sanctions screening, a specific license application, and prompt self-disclosure.
Application. The FBI's attribution to a designated group means a $4.5 million payment is a potential prohibited transaction. Routing it through a broker or the insurer does not cure this: the insurer, the IR firm and the broker are all US persons with their own exposure, and OFAC looks through intermediaries. The 96-hour deadline is commercial pressure, not a legal deadline, and it does not create a defense.
Mitigation. Obtain the attribution in writing; screen the group's aliases and known wallets against OFAC's SDN list; apply for a specific license before paying, and document the application even if it cannot be resolved in time; screen every intermediary; record the diligence contemporaneously; and, if a payment is made, consider self-disclosure to OFAC. The board should be told plainly that insurer approval does not make a payment lawful, and that payment does not guarantee decryption.
2. Analyze the HIPAA notification timing and whether the FBI's request permits a delay.
Read the worked answer
Rule. 45 CFR 164.404(b) requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery; discovery occurs when the incident is known or would have been known with reasonable diligence, and internal investigation time does not toll the clock. Section 164.412 permits a delay of the individual, HHS and media notices only if a law enforcement official states that notification would impede a criminal investigation or cause damage to national security. The statement must be in writing; if it is oral, the covered entity must document it and may delay no more than 30 days unless written confirmation follows.
Application. The phone call does not qualify. The email may qualify only if it comes from a legally authorized official and actually states that notice would impede the investigation - a bare 'request a delay' is not that statement. Even a valid written statement delays only the notices, for the period specified (30 days if none), and does not relieve Lakeshore of documenting the breach, preserving evidence or preparing the notice content.
Conclusion. Discovery was 2 February, so the 60-day outer limit falls in early April. The CEO's plan to notify 'well after' that date is unlawful, and his statement to the board is itself discoverable and will be read as showing deliberate delay. If a valid written delay is obtained, notify as soon as it lapses and record the delay period in the breach log. Separately, Ohio and Pennsylvania breach statutes impose their own content and timing requirements that 164.412 does not suspend.
3. What governance and communication discipline should the board impose while the payment decision, the investigation and the notice obligations run in parallel?
Read the worked answer
Issue. Three legal tracks run concurrently - sanctions, privacy, and fiduciary/contractual duties - and decisions on one constrain the others.
Analysis. On sanctions, the board needs the written attribution, the screening results, the license status and the alternatives. On insurance, paying without the insurer's required pre-approval risks losing the $1.5 million; the pre-approval condition is a coverage term, not a courtesy. On privacy, the notice obligation is independent of the payment decision and must be prepared on its own schedule. On fiduciary duty, the board should minute the options considered - rebuild from backups, negotiate, pay, involve law enforcement - the evidence about whether this group has historically honored payment, and the legal advice received. A decision recorded with its reasoning is defensible; a decision recorded as a conclusion is not.
Communication discipline. Do not state publicly that no data was accessed while forensics is incomplete; do not describe the FBI's request as a legal prohibition when it is not; and do not let any letter to patients, regulator or reporter diverge from the forensic timeline, because the divergence will be discovered. If the exfiltration count rises above 41,000, amend the HHS filing promptly.
Also consider. Reporting to the FBI's IC3 and to CISA; note that CIRCIA's cyber incident reporting requirements are still being implemented through rulemaking, so verify the current status before relying on any federal reporting deadline or safe harbor.