What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Federal prosecutors allege that MonsterCloud owner Zohar Pinhasi told clients his company could recover ransomware-encrypted data without paying attackers, while secretly paying for decryption keys and charging clients substantially more. The U.S. Department of Justice says the alleged scheme involved more than $19 million in client charges and more than $8 million in ransom payments. Pinhasi is presumed innocent unless and until proven guilty.
What prosecutors say happened
According to the U.S. Department of Justice, Pinhasi represented that MonsterCloud LLC used “proprietary tools” and “advanced decryption techniques” to restore files without giving in to ransom demands. Prosecutors allege that, instead, he contacted the attackers who had compromised clients, paid them for decryption keys, and had MonsterCloud employees try those keys on client files. The government says the fees charged to clients were generally substantially higher than the ransom payments. These are allegations in a pending criminal case, not findings after trial. DOJ announcement, October 7, 2026.
The figures in the indictment announcement
DOJ says Pinhasi charged clients more than $19 million and paid more than $8 million in ransom payments as part of the alleged scheme. As one example, prosecutors say that in August 2023 he paid a cybercriminal approximately $8,200 and charged a client approximately $150,000. These are figures reported by prosecutors; the materials do not establish an independently audited loss total or an amount adjudicated by a court.
Charges and case status
A federal grand jury in the Eastern District of New York indicted Pinhasi on September 23, 2026. He was arraigned in Brooklyn on October 7, according to DOJ. The indictment, filed as United States v. Zohar Pinhasi, E.D.N.Y. case 1:26-cr-00271-RER, Document 1, is available here.
#1 Best Overall
As of DOJ’s October 7 announcement, Pinhasi faced two counts of wire fraud and one count of wire-fraud conspiracy. DOJ described a maximum penalty of up to 20 years on each count if convicted. That is a statutory maximum described by the government, not a prediction of a sentence; no conviction or sentence is established by the announcement. DOJ emphasizes that the charges are allegations and that Pinhasi is presumed innocent unless and until proven guilty.
Why the alleged conduct matters to ransomware victims
A company hired to help after a ransomware attack may be trusted with access to systems, files, incident details and decisions about how recovery will proceed. The alleged difference between the service represented to clients and the method prosecutors say was used is therefore central: the government says clients were told recovery would avoid paying attackers, while ransom payments were allegedly made without their knowledge. Prosecutors also allege that the client charges substantially exceeded those payments.
The case is about alleged deception and undisclosed ransom payments; it does not establish that every recovery provider behaves this way or that payment is always the only route to restoring data. Any determination of what happened in this case remains for the court.
What federal guidance says about paying a ransom
DOJ says joint FBI and CISA guidance does not recommend that ransomware victims pay. Its announcement warns that paying does not ensure that data will be decrypted, that systems or data will no longer be compromised, or that stolen data will not be leaked. This summary is attributed to the DOJ announcement; the cited CISA document is linked there as federal guidance.
Rank #3
Questions to ask a recovery provider
The allegations make transparency worth addressing before authorizing recovery work. These are practical questions for evaluating a provider, not a checklist issued by DOJ:
- What work will you perform? Ask the provider to distinguish technical recovery, restoration from backups, negotiation, and any contact with attackers.
- Could you pay or negotiate with an attacker? Ask whether either is contemplated, who can authorize it, and how the provider will disclose any proposed payment and its amount.
- What approvals are required? Get in writing which decisions remain with you, what consent is needed before attacker contact or payment, and how costs are calculated.
- Will you address the original intrusion? Clarify whether the work includes investigating how access was obtained, containing the compromise, and reducing the risk of reinfection—not only restoring files.
- How will evidence and limitations be handled? Ask how logs and other incident evidence will be preserved, what recovery outcomes are uncertain, and what the provider cannot promise.
Clear written answers make it easier to understand what a provider is offering and what decisions you are authorizing during an incident.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors
