The CEO of a Florida cybersecurity company has been charged with fraud for allegedly collecting millions of dollars from ransomware victims while misleading them about how their data was recovered.
Zohar Pinhasi, CEO of MonsterCloud, reportedly told customers his company could restore encrypted files without paying hackers. According to federal prosecutors, MonsterCloud instead paid ransomware operators for decryption keys and charged clients significantly more than the original ransom demands.
The charges involve more than $19 million in client payments and come seven years after a 2019 investigation first questioned the company’s recovery methods.
Why It Matters: Ransomware recovery can leave organizations dependent on outside vendors for critical decisions about system restoration and security. The MonsterCloud allegations expose the financial and operational risks when recovery methods and payments are not fully disclosed. Even after systems are restored, organizations may still face security risks if the original compromise has not been fully addressed.
- Millions in Client Payments Under Review: Federal prosecutors allege that Pinhasi charged customers more than $19 million while paying over $8 million to ransomware operators for decryption keys. In one August 2023 case, MonsterCloud reportedly paid approximately $8,200 to an attacker and billed the customer around $150,000. According to the indictment, clients were not informed that ransom payments were being made as part of the recovery process, despite the company’s claims that it could restore files without paying hackers.
- Recovery Methods Are Central to the Allegations: MonsterCloud advertised proprietary tools and advanced decryption techniques that it claimed could recover encrypted data without paying ransom demands. Prosecutors allege that the company did not have the technology it described to customers and instead contacted attackers directly to purchase decryption keys. Those keys were then used to try to restore affected files.
- Government Agencies Were Among Its Customers: Several local law enforcement agencies turned to MonsterCloud for help after ransomware attacks. A 2019 investigation found that some police departments chose the company because they believed its recovery services would not involve paying hackers. MonsterCloud also featured a former senior FBI official in promotional materials, though he was not named in the indictment.
- Restoring Data Doesn’t Guarantee Security: The FBI alleges that MonsterCloud obtained decryption keys without addressing the security threats behind the original attacks. While those keys can restore access to encrypted files, they do not necessarily remove malicious software, secure compromised accounts or prevent attackers from returning. Federal cybersecurity agencies also warn that paying a ransom does not guarantee successful recovery or prevent stolen information from being released.
- Federal Case Remains Ongoing: Pinhasi was arraigned October 7 in the Eastern District of New York on two counts of wire fraud and one count of wire fraud conspiracy. Each charge carries a maximum sentence of 20 years in prison if convicted. He has pleaded not guilty, and the FBI is continuing its investigation into the allegations.
Cybersecurity CEO Indicted for Allegedly Scamming Millions From Ransomware Victims – Propublica
