Free tools Windows power users keep installed
One-click scans. No signup required.
Angelo Martino is no longer merely a former ransomware negotiator facing charges. He pleaded guilty on April 20, 2026, and was sentenced to 70 months in federal prison on July 9 after admitting that he supplied ALPHV/BlackCat attackers with confidential client information and helped deploy ransomware against additional victims. Two alleged co-conspirators, Ryan Clifford Goldberg and Kevin Tyler Martin, each received four-year prison sentences on April 30, 2026.
The case is an extreme example of trusted-insider risk: a specialist hired to help companies in a ransomware crisis allegedly used the same access and knowledge to improve criminals’ demands and, in a separate strand, participate in attacks.
As an Amazon Associate I earn from qualifying purchases.
What Martino was hired to do
Martino, 41, of Land O’Lakes, Florida, worked as a ransomware negotiator for DigitalMint. In a normal engagement, a negotiator communicates with attackers, tests whether a decryption key may work, assesses what data was taken, manages deadlines and threats, and coordinates with executives, counsel, insurers, forensic investigators and law enforcement.
Negotiators may also help estimate a victim’s ability to pay and evaluate whether a payment is legally and commercially permissible. That does not mean every negotiator sees every financial record. In Martino’s case, prosecutors specifically alleged that he had access to insurance limits, internal negotiating positions and strategy for five DigitalMint clients.
#1 Best Overall
The two strands of the alleged misconduct
Confidential information allegedly passed to BlackCat
The Justice Department said Martino supplied BlackCat actors with information from five clients while negotiating on those clients’ behalf. Prosecutors said the information included insurance-policy limits and the clients’ negotiating positions, allowing attackers to calibrate ransom demands and tactics. The DOJ said BlackCat actors paid Martino for that information. The guilty-plea announcement describes these admissions.
CyberScoop reported that the five clients allegedly paid ransoms and included organizations in the nonprofit, hospitality, financial-services, retail and medical sectors. Court records and reporting should be read carefully here: the claim that Martino negotiated for victims while allegedly helping the opposing side is an allegation tied to the case record, not a finding that every detail has been independently established outside it. CyberScoop’s account also reported that Martino was accused of at least 10 attacks and a combined $75.25 million in ransom payments connected to his broader activity.
Helping deploy ransomware
Martino also admitted conspiring with Kevin Tyler Martin, another former DigitalMint employee, and Ryan Clifford Goldberg, a former incident-response manager at Sygnia. Between approximately April and November 2023, according to the indictment and DOJ accounts, the men used the ALPHV/BlackCat ransomware-as-a-service platform against additional U.S. victims. A DOJ sentencing account describes successful deployment continuing through December 2023; the differing endpoint should be treated as an attribution difference rather than silently reconciled.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
One attack generated approximately $1.2 million in Bitcoin, which the trio agreed to divide after giving BlackCat administrators 20 percent. Goldberg and Martin each pleaded guilty and were sentenced to four years in prison on April 30, 2026. The DOJ sentencing release explains the affiliate arrangement.
How the money figures fit together
The case contains several amounts from different proceedings. They should not be added together or treated as one pot of money.
| Figure | What it refers to |
|---|---|
| Approximately $1.2 million in Bitcoin | The successful payment identified by the DOJ in the three-man attack conspiracy. |
| Approximately $1.27 million | An early report’s figure for a medical-device-company attack in the original indictment coverage. |
| $75.25 million | CyberScoop’s reported total of combined ransom payments allegedly linked to Martino’s broader activity involving at least 10 attacks; it is not money shown to have been personally retained by Martino or collected by the three-man operation. |
| More than $10 million in assets | Cryptocurrency, vehicles, a food truck and a luxury fishing boat that the DOJ said authorities seized from Martino. |
| Nearly $9.2 million in cryptocurrency | CyberScoop’s report of cryptocurrency seized from 21 wallets, a figure drawn from the broader case reporting. |
The early indictment coverage described ransom demands ranging from $300,000 to $10 million against targets including a medical-device company, pharmaceutical company, doctor’s office, engineering company and drone manufacturer. It reported that the medical-device company paid about $1.27 million. That November 5, 2025 report reflects the case’s earlier procedural stage.
Rank #3
What BlackCat’s affiliate model meant
ALPHV, also known as BlackCat, operated as ransomware-as-a-service rather than a conventional company. Administrators maintained malware and criminal infrastructure; affiliates found victims, gained access and carried out attacks. Proceeds were shared under arrangements such as the 20 percent payment to BlackCat administrators described in the DOJ case. The department said the operation had targeted more than 1,000 victims globally. The sentencing announcement provides that description.
Timeline and current legal status
| Date | Event |
|---|---|
| April–November 2023 | Prosecutors said the wider attack conspiracy operated during this period; another DOJ account describes activity through December 2023. |
| November 5, 2025 | The original public report described Martin and Goldberg as indicted and Martino as an unnamed co-conspirator. |
| December 2025 | Goldberg and Kevin Martin pleaded guilty. |
| March 2026 | Court records publicly identified Martino; CyberScoop reported his arrest and broader allegations. He was released on a $500,000 bond, barred from leaving the Southern District of Florida and prohibited from cybersecurity work while the case proceeded. |
| April 20, 2026 | Martino pleaded guilty to conspiracy to obstruct, delay or affect commerce by extortion. The count carried a statutory maximum of 20 years. |
| April 30, 2026 | Goldberg and Martin each received four-year federal sentences. |
| July 9, 2026 | Martino received a 70-month (five-year, 10-month) federal sentence. |
What DigitalMint and Sygnia have—and have not—been accused of
Martino and Kevin Martin worked at DigitalMint; Goldberg worked at Sygnia. The available reporting does not accuse either company of knowingly facilitating the crimes. DigitalMint said it suspended Martino’s access after the DOJ notified it of the investigation, fired him the next day, cooperated with law enforcement and strengthened safeguards and internal controls. It declined to discuss individual client relationships, fee arrangements or possible refunds. CyberScoop and ITPro reported those positions.
Employee misconduct and corporate liability are separate questions. This case establishes neither that DigitalMint or Sygnia knowingly participated nor that ransomware negotiation itself is fraudulent.
Why this is an insider-threat and supply-chain story
The risk was not simply theft from an employer’s network. A crisis-response professional may sit at the intersection of privileged technical access, confidential insurance information, executive decision-making, cryptocurrency settlement and legal deadlines. An insider who manipulates any one of those channels can change a victim’s bargaining position without triggering ordinary endpoint alarms.
The alleged conduct also illustrates a service-provider supply-chain risk. A provider can become an attack multiplier if one person can see sensitive client information, communicate with criminals, recommend a settlement and influence payment execution without independent review. Reporting has described ransomware negotiation as a largely unscrutinized backchannel market, making verification before an incident especially important.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Questions to ask before hiring a ransomware-response provider
- Conflicts: Does every negotiator disclose prior work for the suspected threat actor, financial interests and outside engagements?
- Segregation of duties: Are forensic investigation, negotiation, payment execution and executive approval assigned to separate people or teams?
- Least privilege: Who can see insurance limits, internal payment ceilings, negotiation notes and client communications?
- Independent approvals: Is a second authorized person required to approve a material change in ransom position or any payment instruction?
- Cryptocurrency controls: Are wallet addresses and transaction instructions verified through an independent channel, with fees, spreads or markups disclosed?
- Auditability: Will the client receive access logs, a communications record, chain-of-custody documentation and a post-incident report?
- Personnel oversight: What screening, privileged-access management, insider-risk monitoring and escalation procedures apply to employees and subcontractors?
- Independence: Can the client retain its own counsel, insurer, forensic firm and law-enforcement contacts rather than relying on one intermediary?
- Continuity: Is there a second provider or replacement team if a conflict is suspected?
What to do during an actual ransomware incident
Negotiation is only one part of response, and payment is not inevitable. An organization should isolate affected systems, preserve evidence, activate its incident-response plan, notify counsel and its insurer, and coordinate with law enforcement. CISA’s #StopRansomware guide provides isolation, reporting and coordination guidance.
Best Value
The FBI says it does not support paying a ransom. That is a policy position, not a universal legal prohibition on every payment. Whether payment is permissible and sensible depends on sanctions, law, insurance terms, data-recovery prospects, regulatory duties and business risk. The FBI’s public guidance and reporting channels are available at its ransomware resource.
The practical lesson
A ransomware negotiator should never be the unchecked owner of a company’s technical evidence, financial intelligence, settlement decision and payment. Martino’s guilty plea and sentence show why organizations need conflict disclosures, least-privilege access, dual approvals, complete audit trails and independent legal, forensic, insurance and law-enforcement oversight—even when a trusted professional is working under extreme time pressure.
Frequently Asked Questions
Was Angelo Martino convicted or only charged?
Martino pleaded guilty on April 20, 2026, and was sentenced to 70 months in federal prison on July 9, 2026.
Did Martino personally receive $75.25 million?
No. The $75.25 million figure refers to combined ransom payments allegedly connected to his broader activity. The DOJ separately identified approximately $1.2 million in Bitcoin from the attack conspiracy involving Martino, Goldberg and Kevin Martin.
Does this case mean ransomware negotiation is inherently fraudulent?
No. It demonstrates the danger of an undisclosed conflict and concentrated access, not that legitimate negotiation or incident-response work is inherently improper.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
