Two Incident Responders Sentenced for Covert ALPHV/BlackCat Extortion Attacks

Summary

Two incident responders received four-year sentences after pleading guilty to an extortion conspiracy tied to covert ALPHV/BlackCat attacks. Prosecutors said the scheme yielded $1.2 million and led to a patient-data leak; DigitalMint added auditable negotiation controls

Key points

Ryan Goldberg and Kevin Martin each received four-year sentences after pleading guilty to conspiracy to obstruct commerce by extortion.
Prosecutors said they used their roles at Sygnia and DigitalMint to conduct ALPHV/BlackCat attacks between April and December 2023, alongside Angelo Martino.
The trio extorted one company for $1.2 million; prosecutors said patient data from a doctor's-office victim was leaked.
Martino pleaded guilty to the same charge. The article says he shared confidential victim information, including insurance limits, with ransomware gangs while negotiating for five victims; some ransoms he negotiated reached $26 million.
Law enforcement seized about $10 million in assets from Martino. His sentencing was scheduled for July 9.
DigitalMint introduced cloud-based, auditable negotiation controls, founder oversight of negotiations, and sharing of negotiator information with the Department of Homeland Security.

Article Details

Event Type: Sentencing of incident responders who pleaded guilty to carrying out covert ransomware attacks while abusing their professional roles.
Impact: Ryan Goldberg and Kevin Martin each received four-year prison sentences. Prosecutors said the trio carried out several attacks and successfully extorted one company for $1.2 million; patient data from a doctor’s office victim was leaked. Angelo Martino also pleaded guilty, and law enforcement seized about $10 million in assets from him. DigitalMint introduced auditable negotiation controls and additional oversight.

People

Andrew Tysen DuvaAssistant Attorney General who described the harm to companies providing critical services and the leak of patient data from a doctor’s office victim.Brett LeathermanFBI Assistant Director who said the FBI tracked Ryan Goldberg through 10 countries before his arrest.

Threat Actors

ALPHVThe article identifies the attacks involving Goldberg and Martin as ALPHV/BlackCat ransomware attacks; it does not provide further attribution detail.Angelo MartinoPleaded guilty to the same charge. The article says he participated in attacks with Goldberg and Martin, shared victim insurance limits with ransomware gangs, and helped them pursue larger ransoms.BlackCatThe article identifies the attacks involving Goldberg and Martin as ALPHV/BlackCat ransomware attacks; it does not provide further attribution detail.Kevin Tyler MartinPleaded guilty and was sentenced to four years in prison. Prosecutors said he abused his ransomware-negotiator position to participate in covert ALPHV/BlackCat ransomware attacks.Ryan GoldbergPleaded guilty and was sentenced to four years in prison. Prosecutors said he used his incident-response position to participate in covert ALPHV/BlackCat ransomware attacks.

Vendors

DigitalMintThe scheme involved co-conspirator Angelo Martino, produced a $1.2 million extortion, included leaks of sensitive patient data, and prompted asset seizures and new oversight measures at DigitalMint.SygniaBoth men abused their incident response roles at Sygnia and DigitalMint to identify and extort victim organizations using ALPHV/BlackCat.