A cybersecurity expert who publicly claimed he could beat ransomware has been accused by US prosecutors of paying hackers more than $8 million, in a case that raises fresh questions about how companies respond to extortion attacks and how those responses are billed to clients.
The central allegation is that the expert positioned himself as a defender capable of defeating ransomware, while secretly making large payments to the criminal groups behind the attacks. Prosecutors say the payments totalled more than $8 million. In one scheme, an alleged $8,200 ransom payment was passed on to a victim as a bill of roughly $150,000, according to the prosecution's case.
The figures point to a wider problem in the ransomware economy: the gap between what criminal gangs demand and what victims are ultimately charged. Ransomware attacks typically involve the encryption of a company's systems, followed by a demand for payment in exchange for a decryption key. Victims also face the cost of rebuilding networks, lost trading time and legal and regulatory fallout. Intermediaries — sometimes called negotiators or incident response firms — are often brought in to handle the crisis.
The case is likely to intensify scrutiny of that intermediary market. Companies that suffer an attack are under pressure to restore operations quickly, and they frequently rely on outside specialists whose methods and fees are not always transparent. If the allegations are proven, the case would suggest that some of those specialists may have been working both sides of the transaction: taking money from victims while paying the attackers who had paralysed them.
For British businesses, the alleged conduct is a reminder that ransomware is not only a technical threat but a commercial and governance one. Boards are increasingly expected to understand how an incident response is managed, who is negotiating on their behalf and what payments — if any — are being made. Insurers, auditors and regulators have all begun to ask harder questions about the use of ransom payments, particularly where sanctions or criminal financing rules may be engaged.
The prosecution also highlights the difficulty of measuring the true cost of an attack. A ransom demand is only one line in the ledger. Downtime, lost sales, forensic investigation, legal advice and reputational damage can dwarf the original sum. In the alleged scheme described by prosecutors, the multiplier was dramatic: a payment of $8,200 was said to have become a roughly $150,000 charge to the victim, a mark-up of more than eighteen times.
Cyber security specialists have long warned that paying ransoms encourages further attacks and does not guarantee that stolen data will be deleted or that systems will be fully restored. Many law enforcement agencies, including in the UK, discourage payment and urge victims to report incidents. Yet the decision is often made under extreme pressure, with limited information and against the clock.
The case is expected to sharpen the debate about accountability in the incident response industry. If specialists can be accused of profiting from the very attacks they are hired to resolve, clients may demand greater transparency over fees, negotiation tactics and the flow of funds. That could lead to tighter contracts, more detailed disclosure and, potentially, regulatory attention.
For now, the allegations remain untested in court. But the numbers alone — more than $8 million in alleged payments and a single ransom said to have been marked up from $8,200 to about $150,000 — are likely to make boards and their advisers think harder about who they trust when the worst happens.