Former Cybersecurity Workers Sentenced to Four Years for ALPHV Ransomware Attacks
Summary
Former incident responders Ryan Goldberg and Kevin Martin were sentenced to four years each after pleading guilty to 2023 ALPHV/BlackCat ransomware attacks against U.S. organizations; one victim paid $1.3 million. Co-conspirator Angelo Martino separately pleaded guilty.
Key points
- Ryan Goldberg and Kevin Martin each received four-year prison sentences after pleading guilty to one charge related to 2023 ransomware attacks.
- The pair collaborated with Angelo Martino to use ALPHV/BlackCat ransomware to encrypt systems, steal data and extort organizations.
- Victims included medical, pharmaceutical, engineering and manufacturing organizations; one Florida medical company paid $1.3 million, while the article says the pair received no payments from their other victims.
- Martino exploited his role as a ransomware negotiator to share victims' confidential negotiating positions and insurance limits with co-conspirators.
- Martino separately pleaded guilty; the article says his broader scheme helped accomplices obtain about $75.3 million and that his sentencing was scheduled for July 9.
- Goldberg fled abroad before his arrest in Mexico City and deportation to the United States. His former employers, Sygnia and DigitalMint, were not accused of involvement.
Article Details
- Event Type
- Ransomware attacks by former cybersecurity professionals, followed by criminal convictions and sentencing
- Impact
- Ryan Clifford Goldberg and Kevin Tyler Martin each received four-year prison sentences for 2023 attacks using ALPHV/BlackCat ransomware. They extorted a $1.3 million payment from a medical company; other reported impacts included encrypted systems, stolen data, and patient data leaked from a doctor’s office. Separately, Angelo John Martino III helped accomplices obtain about $75.3 million in ransom payments, according to the article.
People
Andrew Tysen DuvaAssistant attorney general of the Justice Department’s criminal division; commented on harm to medical and engineering victims, including the leak of patient data.Brett LeathermanAssistant director of the FBI’s Cyber Division; described the FBI’s efforts to track Goldberg after he fled the country.Jason A. Reding QuiñonesU.S. attorney for the Southern District of Florida; commented on the defendants’ ransomware attacks and their impact on victims.
Threat Actors
ALPHVRansomware and extortion group linked to attacks on critical infrastructure providers; the article says the group claimed responsibility for the 2024 Change Healthcare attack. The article also identifies ALPHV as BlackCat.Angelo MartinoThe article reports that Martino helped accomplices extort about $75.3 million. He pleaded guilty to sharing confidential victim negotiating positions and insurance limits; sentencing was pending.BlackCatName used in the article for the ransomware and extortion group also identified as ALPHV, which was linked to attacks on critical infrastructure providers and claimed responsibility for the 2024 Change Healthcare attack.Kevin Tyler MartinPleaded guilty and was sentenced to four years in prison for participating in 2023 ransomware attacks using ALPHV/BlackCat to extort victims.Ryan GoldbergPleaded guilty and was sentenced to four years in prison for participating in 2023 ransomware attacks using ALPHV/BlackCat to extort victims.
Malware
Vendors
Countries
Industries
EngineeringTheir attacks targeted medical, pharmaceutical, engineering and manufacturing organizations, resulted in at least a $1.3 million ransom payment in one case, and are linked to broader ALPHV activity including the ChangeFinancial Serviceswith himself and his co-conspirators include a nonprofit and companies in the hospitality, financial services, retail and medical industries.Healthcare$1.3 million ransom payment in one case, and are linked to broader ALPHV activity including the Change Healthcare incident.Hospitalityransomware negotiations with himself and his co-conspirators include a nonprofit and companies in the hospitality, financial services, retail and medical industries.ManufacturingTheir attacks targeted medical, pharmaceutical, engineering and manufacturing organizations, resulted in at least a $1.3 million ransom payment in one case, and are linked to broader ALPHV activity including the ChangeNon-profitMartino to allegedly conduct ransomware negotiations with himself and his co-conspirators include a nonprofit and companies in the hospitality, financial services, retail and medical industries.Retailhimself and his co-conspirators include a nonprofit and companies in the hospitality, financial services, retail and medical industries.