Three Incident Responders at Two Different Cybersecurity Firms Just Pleaded Guilty to Working for BlackCat. They Were Feeding Insurance Policy Limits and Negotiation Positions to the Attackers in Exchange for a Cut. Victims Paid $26 Million Ransoms Not Knowing Their Own Negotiator Was on the Other Side.

TL;DR

The U.S. Department of Justice announced on April 20 that Angelo Martino, a 41-year-old former ransomware negotiator at Chicago incident response firm DigitalMint, pleaded guilty to conspiracy to commit extortion. Martino worked with DigitalMint colleague Kevin Tyler Martin and Ryan Clifford Goldberg, a former incident response manager at Sygnia, to deploy BlackCat/ALPHV ransomware against five U.S. companies in 2023. While negotiating on behalf of victims, Martino fed confidential client information (insurance policy limits, internal negotiation positions) to the attackers to maximize the ransoms. The three conspirators paid BlackCat administrators a 20% cut of the ransom proceeds. Victims included a financial services firm that paid $25.66 million and a nonprofit that paid $26.79 million. This is the third ransomware negotiator to face jail in the past year for similar schemes.

The takeaway

Martino faces up to 20 years in prison at sentencing on July 9.

$10M

Seized from Martino alone

IR pros pleaded guilty

20%

Cut paid to BlackCat admins

WHAT HAPPENED

DigitalMint is a Chicago-based incident response firm that specializes in cryptocurrency brokerage for ransomware victims. When a company gets hit by ransomware and decides to pay, DigitalMint is one of the firms victims hire to negotiate the ransom down, acquire the cryptocurrency, and coordinate the payment. The work requires access to some of the most sensitive information an organization has during a crisis: what they can pay, what their cyber insurance covers, what their internal leadership has authorized, and what their walk-away number is.

According to the DOJ plea agreement, beginning in April 2023, Angelo Martino abused exactly that access. While representing five DigitalMint clients in active ransomware negotiations, he fed the clients' insurance policy limits and internal negotiating positions to the BlackCat ransomware operators. The attackers used that information to calibrate their demands to the maximum the victims could be pressured to pay. Martino took a cut of each ransom.

The scheme did not stop at information leakage. Martino, Martin, and Goldberg conspired to deploy BlackCat ransomware themselves against five U.S. companies between April and November 2023. They paid BlackCat's administrators a 20% affiliate fee for access to the ransomware and extortion portal. Their victims included law firms, school districts, medical facilities, a nonprofit that paid $26.79 million in ransom, and a financial services firm that paid $25.66 million.

Martin (also a DigitalMint negotiator) and Goldberg (a former Sygnia incident response manager) pleaded guilty in December 2025. They are scheduled for sentencing on April 30. Martino pleaded guilty on April 20 and will be sentenced July 9. All three face up to 20 years in prison on a single count of conspiracy to commit extortion.

THE INSIDER THREAT THIS REPRESENTS

Ransomware negotiation is a trust-dependent profession. When a company gets hit, its executives are in crisis. They need someone with expertise who can assess the threat, communicate with the attackers, reduce the demand, and manage the payment. They share everything with the negotiator: the extent of the compromise, what systems are encrypted, what backups they have, what their insurance will cover, what their leadership has authorized them to pay. That information only works as an advantage if it stays confidential between the victim and their representative.

Martino, Martin, and Goldberg weaponized that trust. They knew the victim's walk-away number, so BlackCat could pitch just under it. They knew the insurance policy limit, so BlackCat could anchor demands near the ceiling. They knew whether leadership was willing to go public with the breach, so BlackCat could calibrate threats of data leaks. The information asymmetry that was supposed to protect victims was instead passed to the attackers, and the victims paid tens of millions more than they would have if their negotiator had been honest.

Three incident responders from two different firms. Not isolated individuals. A coordinated scheme. The DOJ describes this as the third such case prosecuted in the past year. That is the detail that matters most for anyone who might need to hire an incident response firm. This is not a one-bad-apple story. This is a pattern. The sensitive access that IR and negotiation work requires creates exactly the conditions that attract insider threats. When the payoff for betrayal is a 20% cut of a $25 million ransom, the math creates its own pressure.

WHAT THE ASSETS TELL YOU

Law enforcement seized roughly $10 million in assets from Martino alone. The itemized seizure list is its own story. Cryptocurrency from 21 different wallets. A luxury fishing boat. Multiple vehicles. Two Florida properties including a bayfront home in Land O'Lakes that Martino purchased for $1.79 million in cash in February 2024. The house was bought ten months after he started feeding client information to BlackCat.

This is what makes the case useful for security teams thinking about insider threat indicators. A ransomware negotiator on a normal salary does not pay cash for a $1.79 million bayfront home within a year of starting the job. The lifestyle indicators are visible if anyone is looking. DigitalMint, which the DOJ explicitly says had no knowledge of or involvement in the scheme, fired Martino the day after the Justice Department informed the company he was under investigation. That happened in April 2025, two years after he started cooperating with BlackCat.

The question for the cyber incident response industry is whether there is a faster detection mechanism than a federal investigation. Compensation patterns, lifestyle changes, and deviations from negotiation norms are all observable. The firms that manage trusted access to victim data need the same kind of insider threat monitoring they advise their own clients to implement.

WHAT THIS MEANS FOR ORGANIZATIONS

1
If you are hiring an incident response firm during a ransomware event, do diligence even in crisis. Reputation, industry references, and explicit conflict-of-interest disclosures matter. Ask who has access to your negotiation positions internally at the IR firm. Ask how that access is audited. Firms that cannot answer these questions should not be handling your ransom.
2
Segment the information that flows to your negotiator. Your insurance limit, walk-away number, and internal board-level discussions about payment authorization do not all need to be in the same email chain or shared workspace with the outside negotiator. Give them what they need to do the work. Withhold what they do not need. The architecture of the data flow is a defense in its own right.
3
For IR firms: treat your negotiators like privileged-access employees. The compensation and lifestyle indicators that flagged Martino are observable inside a firm. A negotiator buying a $1.79 million home in cash is the kind of data point an internal insider threat program should notice. The sensitive access that negotiation work requires is exactly the access most likely to be abused when the personal incentive gets large enough.
4
Understand that cyber insurance coverage limits are a target. If you carry ransomware coverage, the policy limit is data attackers actively want. It changes the ransom demand from a negotiation to an anchor. Consider how that information is stored, who has access to it in your environment, and whether your broker or insurer has safeguards against leaks. An attacker who knows your policy limit has a twenty percent higher starting demand than one who does not.
5
The best long-term defense against ransomware negotiation betrayal is not needing to negotiate. Tested backups, segmented networks, offline recovery paths, and pre-negotiated incident response relationships before a crisis reduce the situations where you are forced to trust a negotiator with your worst-case data. The organizations that practice recovery quarterly pay ransomware operators less often than the ones who plan to figure it out when it happens.

ATARUS ASSESSMENT

The Martino case is a trust story dressed up as a crime story. The reason it matters beyond the specific individuals involved is that ransomware incident response is a professional category that requires unconditional trust between victims and the firms they hire. When three incident responders from two different firms coordinate to betray five clients and walk away with tens of millions of dollars, the entire category of work absorbs the damage. Every ransomware victim going forward will now wonder whether their negotiator is on the level. Every CISO evaluating IR firms will now ask questions that two years ago would have been insulting. And every attacker will look at the Martino case and see a playbook. The 20% affiliate fee paid to BlackCat administrators tells you the economics of the scheme. On a $25 million ransom, the affiliates split $20 million three ways, minus their overhead. The math is going to keep attracting people. For organizations, the lesson is not that IR firms are untrustworthy. Most are. DigitalMint cooperated fully with the federal investigation and fired Martino the day they learned he was under investigation. The lesson is that the old model of "hand over all our sensitive negotiation data to the IR firm and trust them" was always fragile, and three high-profile convictions in a year mean the fragility is now visible. Organizations that want to reduce their exposure need to architect their information flows so no single outside party has enough context to sell out.