Cybersecurity CEO Indicted for Allegedly Scamming Millions From Ransomware Victims - NationofChange

The indictment follows a 2019 investigation by ProPublica that exposed Pinhasi's scheme. According to the Justice Department, Pinhasi told customers he could recover their encrypted files without paying hackers, while actually paying ransoms and charging victims substantial fees on top.

By falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself, U.S. Attorney Joseph Nocella stated in an Oct. 7 press release.

Double Victimization

ProPublica's reporting found that ransomware victims were being harmed twice: first by hackers who locked their files and demanded ransom, and second by MonsterCloud, which misled clients about not paying ransoms. The scheme was particularly damaging to local law enforcement agencies that chose MonsterCloud specifically to avoid engaging with or paying criminal hackers.

Scale of the Fraud

Federal investigators discovered that Pinhasi allegedly charged clients more than $19 million while paying only about $8 million in ransom payments. In one documented case, Pinhasi made a ransom payment of approximately $8,200 but charged the client around $150,000 for the service.

Pinhasi, who described himself as a former IT security intelligence officer for the Israeli military, claimed in 2019 that MonsterCloud handled up to 30 calls daily and employed about 20 people in South Florida with extensive global contacts.

Questionable Connections

The case raised questions about MonsterCloud's connections to law enforcement. Former FBI Deputy Director John Pistole, who also headed the Transportation Security Administration under President Barack Obama, appeared in a promotional video on MonsterCloud's homepage and was listed as the only member of its Cyber Security Advisory Council.

Pistole, who was not mentioned in the indictment, told ProPublica in 2019 that he was aware that in most cases, including MonsterCloud's, the only way to decrypt data locked by ransomware is to pay the hackers. "That's the business model as I understood it," Pistole stated at the time.

Growing Threat

When ProPublica published its story in 2019, ransomware was already one of the world's most pervasive cyberthreats. The problem has since worsened, with hackers linked to hostile foreign governments using ransomware as cover for espionage, and AI tools making it easier for attackers to spread ransomware.

An FBI official stated that Pinhasi had "turned the victim's crisis into his own profit center" and emphasized the agency's commitment to ensuring accountability for those who victimize people who trusted them for help.

Pinhasi pleaded not guilty to the federal charges and faces up to 20 years in prison if convicted. He has not responded to requests for comment since the indictment.