Cyber incident responders who carried out ransomware attacks given 4-year sentences

Two cybersecurity incident responders were sentenced to four years in prison for conducting covert ransomware attacks.

Ryan Goldberg, 40, and Kevin Martin, 36, each pleaded guilty in December to one count of conspiracy to obstruct commerce by extortion and were facing up to 20 years in prison. 

Goldberg worked for incident response firm Sygnia and Martin was a ransomware negotiator for DigitalMint.

Prosecutors said the two worked alongside another co-conspirator, now identified as Angelo Martino, to launch ALPHV/BlackCat ransomware attacks between April and December 2023 — abusing their cyber incident response positions to extort victims. 

The three launched several attacks but only successfully extorted one company, earning $1.2 million from the incident. 

Assistant Attorney General Andrew Tysen Duva said the men harmed important companies that were providing critical services and “played hardball with them, going so far as to cause the leak of patient data from a doctor’s office victim.” 

“These were supposed to be cybersecurity specialists who did good and helped businesses and people,” Duva said.

FBI Assistant Director Brett Leatherman said the FBI had to track Goldberg through 10 countries after he fled abroad before his arrest. 

The sentences come one week after Martino pleaded guilty to the same charge. He stood out among the three because, on top of carrying out attacks with Goldberg and Martin, he coordinated with ransomware gangs while purportedly negotiating ransoms on behalf of five victims. 

Ransomware gangs paid him a fee for confidential information about victim companies and he helped cybercriminals obtain the largest ransom possible by notifying them of the victims’ insurance policy limits. Several of the ransoms he negotiated were massive, with some reaching as much as $26 million. Law enforcement seized about $10 million worth of assets from Martino. 

He will be sentenced on July 9 and is facing 20 years in prison.  

DigitalMint, the company that employed Martino and Martin, instituted several new controls that mandate all negotiations be conducted over cloud-based platforms that can be audited and logged. One of the company’s founders will now personally oversee all negotiations. Ransom negotiators at DigitalMint will also have their information given to the Department of Homeland Security for oversight.