United States: two cybersecurity experts plead guilty to ransomware attacks

Two American cybersecurity professionals pleaded guilty before their country’s courts in late December 2025 for their involvement in ransomware attacks. They are accused of having acted, along with a third unidentified accomplice, as affiliates of ALPHV/BlackCat, a RaaS (Ransomware-as-a-Service) gang dismantled in 2024.

Law enforcement authorities arrested the two men in the fall of 2025. Ryan Goldberg, 40, worked for Sygni, an incident response company. Kevin Martin, 36, was a ransomware negotiator for DigitalMint. Between April 2023 and December 2023, they used their cybersecurity expertise to hack, together with their accomplice, at least five U.S. companies, including three in the healthcare sector.

The indictment states that the attack against a Florida-based medical company earned them $1.2 million (€1 million), of which they paid 20% to the administrators of ALPHV/BlackCat. The three accomplices also published photos of patients from a hacked medical practice on the gang’s leak site.

The two defendants face up to 20 years in prison. The court is expected to hand down their sentence on March 14, 2026.