A US fraud case shows why incident-response suppliers need transparent methods, written authority, cost disclosure and independent oversight.
Introduction
Ransomware victims make expensive decisions while operations are down, customers are waiting and executives are frightened. That pressure creates room for a second failure: trusting the wrong recovery supplier. The US Department of Justice charged the owner of MonsterCloud with wire fraud, alleging that the company claimed to decrypt ransomware with proprietary techniques while secretly paying attackers for keys and charging clients substantially more. The allegations have not been proven, and the defendant is presumed innocent. Even so, the case provides a useful management lesson. Incident-response firms need due diligence before a crisis, written limits during the response and independent verification before invoices, data restoration or ransom-related decisions are accepted.
What happened
According to the Justice Department, Zohar Pinhasi allegedly represented that MonsterCloud could recover data without paying cybercriminals. Prosecutors say the company instead contacted attackers, paid for decryption keys and presented the result as proprietary remediation. The government alleges that clients were charged more than 19 million dollars while more than 8 million dollars was paid in ransoms. One example in the release describes an approximately 8,200 dollar payment to a criminal followed by an approximately 150,000 dollar client charge. Pinhasi faces wire fraud and conspiracy counts. These are allegations in an indictment, not findings of guilt, and the exact facts will be tested through the legal process.
Why it matters for growing businesses
An SME may not have a retained incident-response team, specialist counsel or negotiator. The first vendor found during an outage can therefore receive broad access, urgent payment and authority that would never be granted in normal procurement. A recovery key is not the same as remediation. Systems may remain compromised, stolen data may still be leaked and backups may be damaged. A supplier also faces conflicts if its compensation increases when a ransom is paid or if it controls both negotiation and verification. The business needs to know who is communicating with criminals, who authorizes payment, how fees are calculated and who independently confirms that the environment is safe to restore.
Practical actions this week
Pre-qualify at least two incident-response firms before an emergency. Check legal entity, insurance, named responders, references, sanctions-screening process and relationships with ransomware negotiators. Ask whether the firm ever pays attackers, how that decision is disclosed, and whether fees include a markup on ransom or cryptocurrency. Put authority limits in the contract. Require an itemized record of communications, wallet addresses, payments, tools and work performed. Separate forensic investigation, negotiation, restoration and final security validation where feasible. Involve legal counsel and the insurer early. Preserve logs and affected systems. Never let urgency erase dual approval for funds or the requirement to document who decided what.
Build a response structure
Assign an incident commander, technical lead, legal lead, communications owner and executive decision-maker. Maintain offline contact details because email and identity systems may be unavailable. Define when operations can isolate systems without waiting for a committee. Keep immutable or offline backups and test restoration regularly. During an incident, establish a decision log with timestamps, evidence, options, risks and approvals. Require the recovery supplier to distinguish containment, eradication, decryption and restoration; those are not interchangeable services. After recovery, use an independent party or internal security lead to confirm credentials were rotated, persistence was removed, vulnerable entry points were closed and monitoring is active before normal connections are restored.
How VDS Consultoria can help
VDS Consultoria can help growing businesses prepare a proportionate ransomware plan before a supplier is chosen under duress. We map critical systems, backups, Odoo dependencies, identity services and external contacts; test restore procedures; and define technical and financial authority. We can support vendor evaluation with clear questions about methods, access, fees, evidence and escalation. During recovery planning, we focus on business continuity and independent verification rather than a single promise of decryption. The outcome is a short playbook people can execute, backed by tested backups and pre-agreed contacts. Preparation will not make an attack pleasant, but it can prevent the response itself from becoming another uncontrolled transaction.
Owner checklist
Do you know which systems must be restored first and how long the business can operate without them? Are backups isolated, recent and tested? Is cyber insurance current, and does it require approved vendors or consent before payment? Have responders, counsel and law enforcement contacts been recorded offline? Does the contract prohibit undisclosed ransom payments and hidden markups? Who independently verifies remediation? Who can approve spending, public statements and customer notifications? Run a tabletop exercise that includes a misleading vendor claim and a request for urgent cryptocurrency. The worst time to discover that nobody understands the supplier’s business model is after every screen displays a ransom note.
Source
Known Cybersecurity Expert and Owner of Florida Ransomware Remediation Company Charged with Defrauding Clients, US Department of Justice, 2026-10-07.