US Prosecutors Allege Cybersecurity Professionals Orchestrated Ransomware Extortion

Post by : Raina Nasser

Federal authorities have accused three individuals who worked in cybersecurity of turning their expertise toward criminal hacking, allegedly breaching several US companies and demanding ransom payments.

According to court documents, Ryan Clifford Goldberg, once the Director of Incident Response at Sygnia Consulting Ltd., and Kevin Tyler Martin, a former ransomware negotiator at DigitalMint, are accused of collaborating to penetrate corporate networks and press for extortion payments. The scheme is said to have begun in May 2023 and involved at least five victims.

Prosecutors allege the pair, together with a third collaborator, siphoned almost $1.3 million in cryptocurrency from a Florida-based medical device firm. Investigators say the defendants employed ALPHV BlackCat ransomware to encrypt data and threaten disclosure unless paid.

Both Goldberg and Martin worked in roles intended to help organisations recover from such attacks—firms that negotiate with criminals to restore systems. Authorities contend the suspects exploited that insider knowledge to carry out the same type of intrusions they were meant to mitigate.

DigitalMint has acknowledged Martin’s prior employment and said the alleged conduct was “entirely beyond the scope” of his duties. The company stated its own systems and client information were not breached and that those implicated were dismissed several months ago.

Sygnia confirmed it terminated Goldberg immediately after learning of the allegations and said he is cooperating with investigators.

Goldberg is currently held in federal custody in Florida. Martin was released on bond and has entered a not guilty plea. A third suspected individual, also described as a ransomware negotiator tied to DigitalMint, has not been formally charged.

Investigators believe the group targeted multiple organisations, naming a Maryland pharmaceutical company, a Virginia-based drone maker, an engineering firm and a California medical practice among the alleged victims.

The FBI and the US Attorney’s Office in Miami are heading the investigation, highlighting a rising concern about insiders within the cybersecurity sector turning to illicit activity.