70-Month Sentence Exposes Ransomware Negotiator Betrayal

A ransomware negotiator hired to reduce victims’ losses was sentenced to 70 months in federal prison after prosecutors said he secretly helped BlackCat attackers extract more money from the very clients he was supposed to protect.

That sentence, reported by PYMNTS, is more than another cybercrime penalty. It exposes a weak point inside the ransomware response business: victims often hand sensitive strategy, insurance details, and payment limits to private specialists during a crisis, then trust those specialists to act only in their interest.

XOOMAR analysis: the Angelo Martino case is damaging because the alleged betrayal did not come from outside the recovery process. It came from inside it.

A ransomware negotiator turned client strategy into attacker leverage

Angelo Martino, 41, worked as a ransomware negotiator for Digital Mint. According to the Department of Justice announcement cited by PYMNTS, he was sentenced last week after pleading guilty in April to conspiring to interfere with interstate commerce through extortion.

U.S. Attorney Jason A. Reding Quiñones for the Southern District of Florida put the case bluntly:

“He was hired to help victims in a moment of crisis. Instead, Martino betrayed them, fed their confidential negotiating positions to ransomware criminals, and helped squeeze them for more money.”

Court documents say Martino worked with operators of the BlackCat ransomware group, also known as ALPHV, to extort five different victims. The DOJ said Martino shared confidential information about Digital Mint customers’ negotiating positions and strategies so the attackers could maximize ransoms.

That detail matters. A negotiator’s edge comes from access. In this case, prosecutors said that access became the product.

The Digital Mint case shows how one insider can distort a private negotiation

A ransomware negotiator typically sits between a victim and a threat actor. The job, as described in the Ars Technica account of the sentencing, was to “negotiate with cybercriminals to mitigate the ransoms paid by [DigitalMint’s] clients.”

Martino had access to details about attacks, ransom demands, insurance coverage, and negotiation strategy, according to the factual record summarized by Ars Technica. Prosecutors said he used unauthorized channels with BlackCat actors to share that information without the victims’ knowledge.

The key conflict is brutally simple:

CyberScoop reported that DigitalMint said Martino’s actions were “deliberately concealed from DigitalMint” and violated the company’s values, ethical standards, and the law. The company also said it terminated Martino and suspended his system access after the DOJ notified it of the investigation in April 2025.

XOOMAR analysis: the most important market lesson is not that every negotiator is suspect. It’s that a single insider with privileged information can change the economics of a ransom negotiation before executives even know they’re being played.

The hard numbers: 70 months, five clients, more than $75 million in ransom payments

The 70-month prison sentence is the anchor. The broader math is worse.

According to Ars Technica, five victims Martino was supposed to help paid more than $75 million to ransomware affiliates. The government said those payments included likely millions of dollars in ransom demands inflated because of the confidential information Martino provided.

CyberScoop reported that the five victims included:

• A nonprofit that paid nearly $26.8 million
• A financial services company that paid nearly $25.7 million
• A hospitality company that paid almost $16.5 million

The DOJ also said Martino conspired with Kevin Martin, 36, of Texas, and Ryan Goldberg, 41, of Georgia. Martin was hired as Martino’s coworker after the crimes began, while Goldberg worked for another cybersecurity firm.

The sources distinguish two victim groups. First, the five Digital Mint client victims whose negotiations were compromised. Second, five additional victims that Martino, Martin, and Goldberg targeted as BlackCat affiliates. In that separate activity, the men successfully extorted one victim for approximately $1.2 million in Bitcoin, then split their share three ways and laundered the funds, according to PYMNTS.

Law enforcement has seized $10 million in assets from Martino, including digital currency, vehicles, a food truck, and a luxury fishing boat. A restitution hearing is scheduled for September.

For readers tracking corporate cyber exposure, this case belongs beside broader breach coverage such as Worst Breaches of 2026 Put Millions in Hackers' Hands, not because the facts overlap, but because both show how quickly stolen data and crisis pressure can turn into financial damage.

Victims, firms, insurers, and prosecutors see four different failures

For victims, this is a betrayal case. They hired help during a live extortion event and, according to prosecutors, had their confidential limits and strategy handed to the other side.

For cybersecurity firms, the damage is reputational. DigitalMint said it had no knowledge of Martino’s criminal acts, but the case still raises a hard question for the sector: how do firms prove that sensitive negotiation data is controlled, logged, and insulated from hidden side channels?

For insurers, XOOMAR analysis points to an oversight problem. The sources say Martino had access to insurance coverage information. If that information reaches attackers, it can change ransom dynamics and undermine claims handling.

For prosecutors, the message is deterrence. Martino asked for a 24-month sentence, arguing that he had “provided substantial assistance that contributed to the indictment and conviction of two co-defendants,” according to Ars Technica. He received 70 months.

That gap is the signal.

Ransomware negotiation now has to prove its controls, not just its expertise

PYMNTS wrote earlier this year that negotiating with hackers has become an in-demand job as ransomware has become a “structured, global industry,” with attackers using double extortion to threaten data leaks if victims refuse to pay.

The Martino case shows the darker side of that professionalization. A market built around private chats, confidential limits, fast decisions, and urgent payments depends on trust. Trust is not enough when the person handling the conversation can privately tell attackers where the ceiling is.

Companies hiring ransomware responders should treat this as a governance failure mode, not just a crime story.

Practical controls now look less optional:

• Vendor vetting: Preapprove incident response firms before a crisis.
• Conflict disclosures: Require written disclosures covering outside relationships and prior threat-actor contact.
• Dual control: Separate negotiation authority from payment approval.
• Legal oversight: Keep counsel in the loop on communications and decisions.
• Audit trails: Preserve records of threat-actor chats, payment discussions, and escalation steps.
• Crypto controls: Require sanctions screening, transaction monitoring, and documented legal signoff before any payment flow.

This also connects to the wider enterprise security problem we covered in AI Agents Trip Alarms in Enterprise AI Security Rush: once sensitive systems or workflows gain speed, organizations need tighter permissions and logging, not just smarter tools.

The next test is whether ransomware responders can make trust auditable

Martino’s sentence won’t end ransomware. It won’t eliminate negotiation as a crisis option either.

The real watch item is whether companies, insurers, and response firms move from relationship-based trust to documented controls. Evidence that would support that shift includes stricter vendor panels, clearer client disclosure rules, better logging of negotiator communications, and more explicit payment approval procedures.

Evidence against it would be more cases where insiders use private channels to tilt negotiations in favor of attackers.

XOOMAR analysis: the recovery industry now has to defend its core promise. If a ransomware negotiator sells trust, that trust has to survive scrutiny after the ransom chat closes.

Impact Analysis

• The case highlights the risk of insider abuse during ransomware response, when victims share sensitive strategy and payment limits.
• It may push companies to scrutinize cyber incident vendors more closely before giving them access to confidential negotiations.
• The 70-month sentence signals that authorities are treating collaboration with ransomware groups as a serious criminal offense.