Basically it will be an issue if a company wants to pay ransom and keep it secret. Which is really reasonable and probably if authorities won't be able to help

Basically it will be an issue if a company wants to pay ransom and keep it secret. Which is really reasonable and probably if authorities won't be able to help you and last option will be paying it is not going to be a problem. "OFAC will also consider a company’s self-initiated, timely, and complete report of a ransomware attack to law enforcement to be a significant mitigating factor in determining an appropriate enforcement outcome if the situation is later determined to have a sanctions nexus."