Ransomware Negotiator Sentenced for Colluding with BlackCat/ALPHV Gang

Angelo Martino, a 41-year-old ransomware negotiator formerly employed by Chicago-based incident response firm DigitalMint, has been sentenced to 70 months in federal prison. His crime involved conspiring with the notorious BlackCat/ALPHV ransomware gang, leaking sensitive client negotiation details, insurance coverage information, and internal discussions to the attackers. This betrayal allowed the ransomware group to more effectively extort their victims, ultimately leading to over $75 million in payments from five different organizations.

Martino's scheme began in April 2023, when he started using an intermediary chat channel, hidden from his employer's view, to relay confidential client data to BlackCat/ALPHV negotiators. This intelligence included details about clients' cyber-insurance policy limits and their internal strategies for ransom negotiations, effectively giving the attackers a roadmap for maximizing their demands. The victims, who had hired DigitalMint for assistance, included companies in the hospitality, nonprofit, financial services, retail, and medical sectors.

In one particularly egregious instance, Martino informed DigitalMint that he was transmitting a client's ransom offer to the attackers, while simultaneously assuring the ransomware gang that the client was willing to pay an additional $2 million. This deception directly led to the client paying the inflated ransom amount. The scale of the extortion was significant, with the five victims paying between $213,000 and $26.8 million each during the period Martino was actively feeding information to the attackers.

The betrayal did not stop at leaking information. Martino later escalated his involvement by becoming a BlackCat affiliate himself in May 2023. He collaborated with two other individuals, fellow DigitalMint negotiator Kevin Martin and Sygnia incident response manager Ryan Goldberg, to directly deploy BlackCat ransomware against additional targets. This trio had been planning this operation since the previous year, even before Martino was hired by DigitalMint, demonstrating a pre-existing intent to engage in criminal activities.

Their affiliate activities resulted in substantial criminal proceeds, including $1.2 million extorted from a medical device company. Both Kevin Martin and Ryan Goldberg have since been sentenced to four years in prison in April 2026 for their roles in the conspiracy. Authorities have also seized approximately $10 million in assets from Martino, including cryptocurrency, vehicles, a food truck, and a luxury fishing boat, underscoring the financial scale of their illicit operations.

BlackCat, also known as ALPHV, was a particularly aggressive ransomware operation that gained notoriety for targeting healthcare facilities and, in some cases, publishing sensitive patient data, including images of breast cancer screenings. The gang's infrastructure was disrupted by law enforcement in December 2023, and the FBI subsequently released a decryption tool to aid victims in recovering their files.

Both DigitalMint and Sygnia stated they were unaware of their employees' criminal activities and terminated their employment after being notified by the Department of Justice. The court accepted these claims, but the incident highlights significant failures in vetting and monitoring procedures within these incident response firms. The fact that such a prolonged criminal conspiracy involving insiders across two companies could go undetected raises serious concerns about the internal security and due diligence practices of organizations handling sensitive client data during critical security incidents.

Martino's 70-month sentence falls within the recommended federal sentencing guidelines, which ranged from six to 7.25 years. Prosecutors had sought a sentence in the middle of this range. A restitution hearing is scheduled for September 17, where the court will determine the final amount Martino must pay back to his victims.