Ransomware negotiators occupy a uniquely sensitive position. They are trusted by victims to handle sensitive data and negotiate directly with attackers — and a growing number of cases suggest that some negotiators have exploited that trust for personal gain.
In July 2026, Angelo Martino, a former ransomware negotiator at a U.S.-based cyber incident response company, was sentenced to 70 months in prison for conspiring with BlackCat ransomware affiliates to extort millions of dollars from five U.S. companies — some of which were his employer’s clients. Court documents describe a larger scheme that also involved two other former cybersecurity professionals.
“He was hired to help victims in a moment of crisis,” said U.S. Attorney Jason Reding Quiñones for the Southern District of Florida. “Instead, Martino betrayed them, fed their confidential negotiating positions to ransomware criminals, and helped squeeze them for more money.”
In October, Zohar Pinhasi, a U.S. and Israeli national, was arraigned in the Eastern District of New York on wire fraud charges relating to alleged false representations that he could decrypt ransomware without paying cybercriminals. Over the course of the scheme, he allegedly charged clients more than $19 million and paid more than $8 million in ransom payments, the U.S. Department of Justice said.
The cases, along with other high-profile incidents involving prominent cybersecurity professionals, raise an uncomfortable question for ransomware-hit organizations: Can they trust the third-party experts they hire to negotiate with cybercriminals on their behalf?
Ransomware negotiation market ‘like the Wild West’
By definition, ransomware negotiators see a victim’s real negotiating limits and strategy, while also communicating directly with the attackers demanding payment. That dual vantage point creates a built-in opportunity for insider betrayal that’s difficult to detect from either side.
“They may know the victim’s recovery options, financial limits, insurance position and willingness to pay,” said Tom Meurs, a cybercrime researcher with the Dutch police who has studied ransomware negotiation outcomes. “That information is extremely valuable to the attacker. So even if abuse is rare, it is a serious insider risk, and firms should treat it that way.”
Tracy (Kitten) Goldberg, director of cybersecurity at research firm Javelin Strategy & Research, described the ransomware negotiation market as being “kind of like the Wild West,” lacking widely established best practices and protocols.
Anna Cartwright, an expert in the economics of cybersecurity, called the recent arrests “a potential wake-up for the industry as a whole.”
That doesn’t mean, however, that enterprises should never hire ransomware negotiators. In fact, Cartwright said her research shows that ransomware victims that enlist third-party incident response (IR) firms generally see better outcomes.
"I would rather have an experienced IR or negotiation firm involved than have an internal team improvise,” Meurs agreed, noting that his own research suggests an organization that hires a third-party incident response firm is not more likely to pay a ransom — but is more likely to secure a ransom discount if it does pay.
“A ransomware incident is complex and very difficult to deal with. There are obvious benefits to having experts in the room, who have experience,” Cartwright said.
The key, she added, is to establish ongoing relationships with vetted, reputable negotiators well in advance of an incident, as part of standard business continuity and disaster recovery planning.
“At the moment of an incident, emotions are running high, human beings are naturally going to panic,” Cartwright said. “This makes them vulnerable to third parties with claims that they can offer quick fixes.”
How to vet your ransomware negotiator
Goldberg agreed that a ransomware incident is generally not the time to go it alone, saying organizations need third-party support. But she also recommended CISOs exercise a reasonable degree of caution when working with ransomware negotiators.
“You’re kind of letting them into your home, if you will,” she said. “You wouldn’t let a stranger into your home unless that person was recommended by someone that you know.”
Similarly, cyber insurers often recommend trusted incident response firms to their clients. But while a CISO should consider an insurer’s short list a reasonable starting point, experts urged them to independently vet providers. And, once negotiations are underway, maintain a high level of involvement and total visibility into the process.
“You can’t just have a ransomware negotiation provider that’s out there negotiating without any oversight or coordination or communication with other players in the ecosystem,” Goldberg said. She also recommended writing formal procedural checkpoints into contracts — for example, requiring a provider to prove they pursued a non-monetary settlement as part of negotiations.
Although the risk is real, experts generally agreed that duplicity in ransomware negotiations is rare. Ultimately, organizations should vet third-party service providers as part of standard incident response planning — and ensure other security controls minimize their exposure.
“If you have working backups, you have leverage,” Meurs said. “If you cannot recover, even a very good negotiator is bargaining from a weak position.”
Alissa Irei is a TechTarget senior reporter covering cybersecurity news.
James Walker is lead editor at TechTarget Cybersecurity.
