Angelo Martino, a former ransomware negotiator at the company the Justice Department identified as DigitalMint, secretly helped BlackCat/ALPHV extort clients and also joined a separate ransomware attack conspiracy. He pleaded guilty in April 2026 and was sentenced in July.
Who was the DigitalMint ransomware negotiator?
Martino, 41, of Land O’Lakes, Florida, worked on the victim side of ransomware incidents, helping clients negotiate with attackers. According to the U.S. Department of Justice, he used that trusted position to provide BlackCat/ALPHV operators with confidential information without permission from either his clients or his employer.
The DOJ’s account identifies DigitalMint as the cyber incident-response company where Martino worked. It describes Martino’s conduct; it does not allege in the cited releases that DigitalMint or the affected clients authorized his assistance to the attackers.
What information did Martino give BlackCat?
Beginning in April 2023, Martino supplied information about five clients he represented. The material included their internal negotiating positions, strategies, and insurance-policy limits. The attackers paid him for the information, which could help them set or press ransom demands with knowledge of what a victim might be prepared to pay.
#1 Best Overall
This was an insider abuse of access to incident-response and insurance-related information: the negotiator knew details that victims would not ordinarily choose to reveal to the people extorting them.
What was the separate ransomware conspiracy?
Martino also conspired with Kevin Martin and Ryan Goldberg to deploy BlackCat ransomware against additional U.S. victims. In one attack, the group extorted approximately $1.2 million in Bitcoin, divided the proceeds, and laundered the funds, according to the DOJ.
That activity was distinct from Martino’s disclosure of information obtained through his negotiator role: the case involved both helping attackers exploit confidential client information and taking part in a separate attack operation.
What did Martino plead guilty to, and what sentence did he receive?
On April 14, 2026, Martino pleaded guilty to one count of conspiring to obstruct, delay, or affect commerce through extortion. The DOJ said the count initially carried a statutory maximum of 20 years in prison. On July 9, 2026, he was sentenced to 70 months in federal prison.
Rank #3
| Defendant | Sentence | Sentencing date |
|---|---|---|
| Angelo Martino | 70 months | July 9, 2026 |
| Kevin Martin | 48 months | May 1, 2026 |
| Ryan Goldberg | 48 months | May 1, 2026 |
The DOJ reported that law enforcement seized assets tied to Martino valued at $10 million, including digital currency, vehicles, a food truck, and a luxury fishing boat. The July sentencing release said a restitution hearing was set for September 17, 2026; it does not state the outcome of that hearing.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What does the case mean for incident-response and cyber-insurance workflows?
The case illustrates why sensitive information should be protected even when it is shared with professionals working to resolve an attack. Negotiation positions and policy limits can give extortionists leverage if they reach the wrong person or are disclosed without authorization.
- Limit access: Give staff only the client and insurance information needed for their assigned work.
- Control disclosure: Set clear approval requirements for sharing policy limits, negotiation strategy, or other confidential details outside the response team.
- Keep an audit trail: Record who accessed or disclosed sensitive information and when, so unusual activity can be reviewed.
- Separate duties where practical: Use independent review for high-impact disclosures and changes to negotiation strategy.
These are general risk controls suggested by the type of access abused in this case, not additional allegations made by the DOJ.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
