Sygnia, DigitalMint insiders get 4 years for moonlighting as BlackCat affiliates

Two incident response professionals who were supposed to defend victims instead joined the attackers. Ryan Clifford Goldberg, a former Sygnia IR manager, and Kevin Tyler Martin, a DigitalMint ransomware negotiator, were each sentenced to four years in federal prison after pleading guilty to conspiracy to obstruct commerce by extortion. Working with a third accomplice, Angelo Martino, they operated as BlackCat (ALPHV) affiliates between May and November 2023, paying the gang a 20% cut for access to its ransomware and extortion infrastructure.

The pair hit a string of U.S. targets including a Maryland pharmaceutical firm, a Tampa medical device manufacturer, a California engineering company, a Virginia drone maker, and a doctor’s office. The medical device victim paid $1.27 million against a $10 million demand, with proceeds laundered and split three ways. Ransom demands across the other intrusions ranged from $300,000 to $10 million.

The case lands inside a structural weak point of the IR industry: the same people negotiating ransoms have intimate knowledge of victim leverage, payment workflows, and which gangs accept which crypto rails. DigitalMint says it terminated both employees on discovery. BlackCat itself has been tied by the FBI to 60+ breaches in its early run and over $300 million extracted from 1,000+ victims through September 2023.