Florida Ransomware Negotiator Convicted for Helping Hackers Extort U.S. Companies

Florida man Angelo Martino was sentenced to more than five years in prison for conspiring with hackers to deploy ransomware while working as a ransomware negotiator for a U.S. cybersecurity company. The U.S. Department of Justice confirmed the sentence and said the government seized more than $10 million worth of cryptocurrency and assets.

Those seized assets allegedly included a food truck and a luxury fishing boat bought with money stolen in the hacks. The case stands out because it involved a security professional accused of helping the very kind of criminal activity companies hire negotiators to manage.

Martino is the third person jailed in the scheme, after cybersecurity professionals Kevin Martin and Ryan Goldberg. Prosecutors said the trio worked together to deploy BlackCat ransomware against U.S. companies throughout 2023.

In one successful attack, the group extorted a company for about $1.2 million, then split the money three ways after laundering the funds. The case underscores the risks companies face when trusted incident-response roles are abused from the inside.

Ransomware and extortion attacks have helped create a U.S. insurance sub-sector focused on responding to these incidents. Some companies in the space employ negotiators to try to reduce ransom demands.

Governments have long advised victims not to pay ransoms because payment can help cybercriminals profit. Still, some companies pay in attempts to stop customer data from being leaked.

BlackCat, also known as ALPHV, is a ransomware-as-a-service operation that lets independent hackers rent access to file-encrypting malware in exchange for a cut of cyberattack profits. Its ransomware has been tied to major attacks, including the theft of highly sensitive medical and billing data from more than 192 million people in the Change Healthcare hack in February 2024.

The affiliate hackers responsible for that 2024 data breach were never identified, according to the TechCrunch report. For businesses, the takeaway is clear: ransomware risk is not just technical, but operational, financial, and vendor-related.