Cyberscoop DigitalMint Negotiator Charged for $75 Million Ransomware Scheme
Article Content
- •Angelo Martino III charged with extorting $75 million through ransomware attacks.
- •Martino acted as both negotiator and attacker, exploiting insider knowledge.
- •DigitalMint has terminated Martino and cooperated with law enforcement.
Angelo John Martino III, a former ransomware negotiator for DigitalMint, has been charged with conspiracy to interfere with interstate commerce by extortion. He allegedly conducted at least 10 ransomware attacks between April 2023 and April 2025, extorting over $75 million from victims including a nonprofit and companies in various sectors. Martino shared confidential negotiation information with BlackCat (ALPHV) ransomware operators, enabling him to maximize ransom payments. He was previously identified as a co-conspirator in an indictment against two other former DigitalMint employees who have already pleaded guilty. DigitalMint has stated it was unaware of Martino's criminal activities and has since terminated his employment. The company has cooperated with law enforcement and strengthened internal controls to prevent similar incidents. The victims included organizations in the medical, financial, hospitality, and retail industries, all of which paid ransoms. Martino surrendered to authorities on March 10, 2026, and is scheduled for further legal proceedings.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track Alphv and Change Healthcare in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Malware Analysis Reveals 30% of Dark Web Executables Are Malicious A recent study analyzed over 20,000 executable files harvested from the Dark Web, revealing that 30% are classified as malicious by various malware analysis tools. The research utilized a crawler that scanned over 15 million web pages to collect these files. The analysis employed services like VirusTotal, Hybrid…
Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…