The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The investigation-stage story has since reached a court outcome: the U.S. Department of Justice says former ransomware negotiator Angelo Martino pleaded guilty in April 2026 and was sentenced on July 9, 2026, to 70 months in prison. Prosecutors said he secretly shared five clients’ confidential negotiation information with ALPHV/BlackCat attackers and separately joined a conspiracy to attack victims.
What happened in the case
Martino formerly worked as a ransomware negotiator for a U.S.-based cyber incident-response company. The Justice Department did not name the employer in its announcements. A July 2025 report by HotHardware identified the company as DigitalMint; that identification is secondary reporting, not a detail confirmed in the later DOJ releases.
As an Amazon Associate I earn from qualifying purchases.
Confidential information allegedly went to attackers
According to the DOJ, beginning in April 2023 Martino provided ALPHV/BlackCat actors with confidential information about five clients’ negotiating positions and strategies, including insurance limits. The department said he did so without the clients’ or his employer’s knowledge or permission, and the attackers paid him for the information. Martino pleaded guilty to a one-count conspiracy charge involving extortion.
A separate ransomware attack conspiracy
The DOJ also said Martino conspired with former cybersecurity professionals Ryan Goldberg and Kevin Martin to deploy BlackCat ransomware against additional U.S. victims during 2023. In that separate scheme, prosecutors said one victim was extorted for approximately $1.2 million in Bitcoin and that the men divided their share three ways. The allegation is distinct from the disclosure of client negotiation information.
#1 Best Overall
Sentences, seizures and restitution status
| Person or issue | DOJ-reported outcome |
|---|---|
| Angelo Martino | 70 months in prison; sentenced July 9, 2026, after pleading guilty in April 2026. |
| Ryan Goldberg and Kevin Martin | 48 months in prison each; sentenced May 1, 2026. |
| Assets seized from Martino | $10 million in assets, including digital currency, vehicles, a food truck and a fishing boat, according to DOJ. |
| Restitution | DOJ said Martino’s restitution hearing was scheduled for September 17, 2026. The cited announcements do not establish the hearing’s outcome. |
The DOJ’s July 9, 2026 sentencing announcement describes the sentence, prosecution account, seizures and scheduled restitution hearing. Its April 20, 2026 plea announcement sets out the plea and disclosures. A separate DOJ announcement covers Goldberg and Martin’s sentences.
Why the alleged kickbacks mattered to clients
Ransomware negotiators may handle sensitive details about a victim’s ability or willingness to pay. In this case, DOJ said the information included insurance limits and negotiating strategy—facts that could affect how attackers assess a target and conduct a demand. The case illustrates why organizations engaging incident-response or negotiation help may want to ask about conflicts of interest, confidentiality protections and how the provider separates advice to a victim from any payment-related arrangements. It does not establish that a particular provider is trustworthy or that any specific safeguard is legally required.
The Justice Department framed the case as involving both betrayal of client confidences and participation in attacks. U.S. Attorney Jason A. Reding Quiñones said: “Instead, Martino betrayed them, fed their confidential negotiating positions to ransomware criminals, and helped squeeze them for more money.”
What this case does—and does not—show
This is a U.S. federal criminal case involving named defendants, U.S. victims and a U.S.-based incident-response company. It demonstrates that prosecutors pursued both an insider who allegedly passed along client information and a separate conspiracy to deploy ransomware. The available announcements do not provide a broader measure of how often ransomware negotiators receive kickbacks or engage in insider misconduct, so the case should not be treated as evidence of industry-wide prevalence.
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
