An insurance company did not have the right to refuse to pay its insured client, a victim of a cyberattack who had made a ransomware payment, even if it claimed that its obligation to reimburse the ransomware payment would expose it to US sanctions.