Ransomware Negotiator Sentenced to 70 Months for Feeding Victims' Confidential Strategies to BlackCat Attackers

The Scheme

Angelo Martino worked as a ransomware negotiator for DigitalMint, a company that companies hire specifically to reduce what they pay cybercriminals. His job was to lower the bill. He did the opposite.

According to a sentencing memorandum filed by the US government, Martino passed confidential negotiation information directly to BlackCat ransomware affiliates. The attackers used that inside knowledge to hold firm, push back, and squeeze higher payments out of victims who had no idea their own negotiator was working against them.

Five DigitalMint clients paid over $75 million in ransoms during the scheme, which ran from April 2023 to September 2023. Individual ransoms ranged from $213,000 to $26.8 million. The US government says a portion of those totals was inflated specifically because of information Martino supplied.

Martino received millions of dollars in cryptocurrency as his cut, according to a factual proffer he and US prosecutors both signed. The FBI seized cryptocurrency from him, but he had already converted much of it into two houses in Florida, a boat, and several vehicles.

Who Else Was Involved

Martino was not the only insider. Kevin Martin, a fellow DigitalMint ransomware negotiator based in Texas, and Ryan Goldberg, an incident manager at security firm Sygnia based in Georgia, were charged in November 2025. Both pleaded guilty. Martin and Goldberg were each sentenced to four years in prison in April 2026.

Martino's name had not been made public when Martin and Goldberg were charged. He was charged in February with conspiracy to interfere with interstate commerce by extortion, which carries a maximum sentence of 20 years.

In asking for leniency, Martino's legal team noted that he pleaded guilty and provided cooperation that contributed to the indictment and conviction of Martin and Goldberg. He requested a 24-month sentence. The government disagreed. Sentencing guidelines based on Martino's limited criminal history placed the recommended range at 70 to 87 months, and prosecutors asked for at least the midpoint of that range. The judge sentenced him to 70 months, the bottom of that window.

Victims and Real-World Damage

The victims were not abstract corporate entities. According to the US government, they included companies in financial services, hospitality, retail, a nonprofit, and a medical company. The government stated directly that the conspiracy "affected the ability of victims including companies in the financial services and health industry to provide services to customers." Hospitals and financial firms were disrupted while a man they were paying to protect them was making the problem worse.

FBI Cyber Division Assistant Director Brett Leatherman said: "Angelo Martino sold out the very victims he was hired to represent, handing their confidential negotiating positions to BlackCat actors to drive up ransoms and enrich himself."

The Strongest Defense, and Why It Doesn't Hold

Martino's cooperation is a legitimate mitigating factor. Without him flipping, Martin and Goldberg may not have been convicted. The legal system gives credit for that, and it should. His cooperation also helped the government map out how the conspiracy worked, which is valuable for future prosecutions and for understanding how deeply ransomware networks can penetrate the firms hired to fight them.

But the sentencing math is still 70 months. His assistance earned him the low end of the guideline range. It did not get him anywhere near the 24 months he requested. And it does not change what he did: he took money from victims in crisis, then sold them out to make their crisis worse.

What Comes Next

On the financial accountability side, the case is not fully resolved. The government is due to submit a proposed order of forfeiture by next week. Martino must also forfeit property and pay 10 percent of any salary he earns after release. What the government actually recovers, and how much of that flows back to victims, depends on what assets can still be seized. Two Florida houses, a boat, and multiple vehicles are on the table.

The deeper unresolved question is structural. Ransomware negotiation is a lightly regulated industry. There is no federal licensing requirement, no mandatory fiduciary standard, and no centralized oversight of who can hold themselves out as a ransomware negotiator. A company that just had its network locked can call a firm like DigitalMint in a panic, hand over their maximum payment threshold, and have zero guarantee the person on the other end of the line isn't already talking to the attackers.

Martin, Goldberg, and Martino were caught. The government's sentencing memorandum does not address how many others in similar roles have not been.