On October 7, 2026, the U.S. Department of Justice announced that Zohar Pinhasi, who led ransomware-remediation company MonsterCloud, had been indicted and appeared in federal court in Brooklyn. Prosecutors accuse him of misleading clients about how their files were recovered. The accusations are set out in an indictment: Pinhasi is presumed innocent unless and until proven guilty.
What the indictment alleges
According to the DOJ, MonsterCloud offered businesses affected by ransomware a service presented as an alternative to paying the ransom. Prosecutors allege that Pinhasi claimed to have proprietary decryption techniques but instead contacted cybercriminals and paid for a key that employees then used to attempt to restore files.
The indictment alleges that clients were not necessarily told about the payment actually made and that the amount billed sometimes greatly exceeded the ransom. The DOJ cites an example of about $8,200 paid to an attacker in August 2023 while the client was allegedly charged about $150,000. This example illustrates the prosecutors’ allegations; it does not necessarily describe every MonsterCloud contract or engagement.
The amounts and charges
Prosecutors allege that Pinhasi billed clients more than $19 million and paid more than $8 million in ransom. A grand jury indicted him on September 23, 2026, and he appeared in court on October 7. BleepingComputer reports that he pleaded not guilty and was released on bond.
The DOJ says the charges concern alleged fraud and that the defendant is presumed innocent. The statutory maximum described by the department is not a sentence imposed: only a conviction and court decision could determine any penalty.
Why provider transparency matters
During a crisis, a business may need to decide quickly whether to restore from backups, bring in a specialist, or consider different options. A provider should explain in writing what it knows, its proposed methods, costs, risks, and which decisions remain with the client.
Before an engagement, ask whether the provider will contact attackers or pay a ransom, under what conditions it might do so, and what prior approval it needs. Ask how it will check whether the initial cause has been addressed, how temporary keys and access will be protected, and what evidence it will return. These precautions help clients make informed decisions; they do not prejudge the ongoing case.
What organizations can prepare
Document in advance who can authorize an exceptional expense, who contacts insurers and legal counsel, and how ransom-related decisions are made. Keep separate backups and test their restoration so you have independent options. During an engagement, limit temporary access to what is necessary and revoke it when the work ends.
If a provider needs access to consoles or administrator accounts, create named, temporary access where possible. Avoid sending shared passwords through email or ordinary messaging; record the access granted, its duration, and its revocation. A clear procurement process reduces pressure and misunderstandings when an organization is most vulnerable.
How Soclyde relates
Soclyde does not respond to ransomware incidents, negotiate with attackers, or validate a provider’s methods. Its local-first encrypted vault helps a team manage access credentials with controlled permissions, while choosing a responder, maintaining backups, and making restoration decisions require separate operational preparation.
What to remember
Prosecutors accuse the MonsterCloud owner of concealing ransom payments from some clients and billing them more than the ransom. These are allegations, and Pinhasi is presumed innocent. Organizations can reduce uncertainty by clarifying a provider’s methods, fees, and approval requirements in advance and by maintaining tested backups. See our password vault backup guide to plan access recovery.
