Recent criminal cases involving ransomware response specialists highlight the risks of outsourcing negotiations and recovery, raising questions about transparency, financial oversight and the protection of victims during cyber incidents. Recent US criminal cases involving cyber-security professionals have raised concerns about the trust organisations place in external specialists during ransomware incidents. Allegations of extortion and fraudulent recovery services highlight the risks of handing sensitive information and financial decisions to third parties during a crisis.
In October 2026, Canadian cyber-security executive Edward Dubrovsky was arrested in Philadelphia on federal extortion-related charges. According to Reuters, the arrest came amid an FBI investigation involving the ShinyHunters hacking group. The precise relationship between Dubrovsky’s alleged activities and the group’s operations remained unclear. The allegations have not been proven.
A separate case involving Florida-based ransomware remediation company MonsterCloud illustrates the potential financial consequences for victims.
On 7 October, the US Department of Justice announced charges against company owner Zohar Pinhasi, alleging that he misled customers about how their encrypted data was recovered.
Prosecutors claim MonsterCloud secretly negotiated with cybercriminals and purchased decryption keys while telling customers that its proprietary technology could recover their data without paying a ransom.
Between 2018 and 2023, Pinhasi allegedly collected more than $19 million from customers while paying attackers over $8 million. In one instance, prosecutors say a customer was charged approximately $150,000 after the company paid criminals around $8,200. Pinhasi is presumed innocent unless proven guilty.
Although the cases involve different allegations, both highlight the considerable responsibility organisations may delegate to ransomware response providers.
External negotiators can gain access to confidential business information, compromised systems and communications with attackers. Some may also advise organisations on whether to pay a ransom while facilitating the transaction themselves.
For CISOs, this creates questions about oversight and potential conflicts of interest. Organisations should establish who can authorise negotiations, approve payments and verify claims made by recovery specialists.
Transparency over recovery methods is particularly important. Customers should know whether their systems were restored using backups, technical decryption tools or keys purchased from attackers. Contracts should require disclosure of ransom payments, associated fees and any third parties involved.
There are also regulatory risks. The US Treasury’s Office of Foreign Assets Control has warned that organisations facilitating ransomware payments may face sanctions exposure when transactions involve designated individuals or entities.
Businesses can reduce these risks by vetting incident response providers before an attack, establishing contractual safeguards and maintaining independent oversight of negotiations and payments.
The recent cases provide a reason to review those arrangements. During a ransomware incident, organisations may have little time to question a specialist’s advice or investigate how recovery is being achieved. Clear contractual obligations and approval procedures can help ensure that urgent decisions remain accountable.
——————————————————–
Click Here For The Original Source.
