On Friday, March 6, 2026, the White House issued a sweeping Executive Order (EO) titled, “Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens.” The EO reflects what most organizations already know all too well: cybercrime is no longer an episodic threat. It is a relentless, organized enterprise that is inflicting devastating financial, operational, and human harm across the globe and, in particular, in the United States.

The Trump Administration also published in March a Cyber Strategy for America, laying out six pillars underpinning the cyber strategy: Shape Adversary Behavior, Promote Common Sense Regulation, Modernize and Security Federal Government Networks, Secure Critical Infrastructure, Sustain Superiority in Critical Technologies, and Build Talent and Capacity.

At the center of the EO is a whole-of-government strategy to disrupt transnational criminal organizations (TCOs) responsible for ransomware attacks, business email compromise (BEC), online fraud schemes, and other predatory cyber activity. It directs federal agencies to coordinate more effectively, prioritize enforcement, strengthen international pressure, and explore ways to return seized funds to victims.

According to the EO:

It is the policy of the United States to protect Americans from, and harden our financial and digital systems against, these threats.  The United States shall counter attacks on Americans with a commensurate response that includes law enforcement, diplomacy, and potential offensive actions.  It is further the policy of the United States to provide support to victims of these crimes, expand public alerts, and prioritize protection for those most at risk to end the exploitation and victimization of Americans.

The Cyber Strategy for America goes a bit further, promising:

American citizens, companies, and our allies should not have to fend off sophisticated military, intelligence, and criminal adversaries in cyberspace alone. We will deploy the full suite of U.S. government defensive and offensive cyber operations.

The Devastating Impact of Ransomware

Ransomware remains one of the most destructive forms of cybercrime. A single successful intrusion can paralyze operations overnight—shutting down hospitals, manufacturing lines, school systems, and critical infrastructure. Beyond the ransom demand itself, organizations face business interruption losses, regulatory scrutiny, litigation exposure, forensic costs, notification obligations, and reputational damage that can linger for years.

For smaller organizations in particular, a ransomware attack can be existential. Even when backups exist, recovery is time-consuming and expensive. Sensitive data may be exfiltrated and later weaponized in extortion campaigns. The operational disruption alone can undermine client trust and strain workforce morale.

The EO acknowledges that ransomware campaigns are frequently coordinated by sophisticated TCOs operating with relative impunity abroad. By focusing federal resources on identifying, disrupting, and dismantling these networks, the Administration aims to attack the problem at its source—not merely respond after the damage is done.

Business Email Compromise and Financial Fraud

Another common type of attack, “business email compromise” or “BEC,” continues to quietly generate billions in losses annually. See, e.g., FBI Internet Crime Report 2024. Unlike ransomware, BEC often does not involve malicious code or dramatic system outages. Instead, threat actors gain access to email account largely through phishing campaigns and exploit trust—impersonating executives, vendors, or clients to redirect payments or manipulate financial transactions.

The harm can be immediate and severe. Funds wired in response to fraudulent instructions are often moved quickly through multiple accounts, making recovery difficult. Organizations must then manage internal investigations, insurance claims, regulatory notifications, and strained business relationships.

These schemes are not random acts by lone actors. They are frequently part of organized criminal enterprises that specialize in reconnaissance, social engineering, and rapid monetization. The EO’s emphasis on prioritizing prosecution of cyber-enabled fraud and strengthening interagency coordination may improve the speed and effectiveness of disruption efforts—particularly where international cooperation is required.

Organizations as Targets—Not Just Defendants

One of the most important themes underlying both the EO and the Cyber Strategy is the recognition that U.S. organizations are often victims in these matters, along with persons, critical infrastructure, and public services. The EO seeks recommendations for a “Victim Restoration Program” designed to provide restoration to cyber crime victims from funds clawed back, forfeited, or seized from the TCOs that perpetrate such schemes.

Certainly, organizations can and should do more to protect their information systems, although security gaps will remain and human error will persist. No system is perfect. But it is critical to understand the broader context: most organizations today are inundated with constant attack attempts. Automated scanning, credential stuffing, phishing campaigns, and brute-force login attempts occur around the clock. Threat actors leverage artificial intelligence, exploit kits, and dark web marketplaces to scale their operations.

Even well-resourced companies with mature cybersecurity programs face a daily barrage of intrusion attempts. For mid-sized and smaller entities, the challenge can be even greater even with a smaller attack surface. The cybersecurity battlefield is asymmetric. Defenders must secure every entry point; attackers need only one.

We Have Heard This Before

Prior administrations have made similar announcements and taken some steps to address this ongoing concern. Yes, cyber risks continue to be paramount for many organizations. So, it remains to be seen whether the efforts outlined in the EO and the Cyber Strategy will be successful. We hope they will.

No executive action or published strategy will eliminate ransomware or fraud overnight. But a coordinated effort that integrates law enforcement, intelligence, diplomacy, and victim support represents an important step forward. In the meantime, for U.S. organizations, the fight against cybercrime remains ongoing. Continued investment in cybersecurity governance, employee training, incident response readiness, and third-party risk management is essential.