Angelo Martino, a Florida man employed as a ransomware negotiator at a US cybersecurity company, has been sentenced to more than five years in prison for secretly conspiring with hackers to deploy ransomware against American companies. The case is notable because it exposes a rare instance of security professionals abusing their trusted positions to commit the very crimes they were paid to defend against. The US Department of Justice confirmed the sentence on Thursday and said it had seized more than $10 million in cryptocurrency and assets, including a food truck and a luxury fishing boat allegedly bought with stolen funds.

Martino is the third person jailed over the scheme, after cybersecurity professionals Kevin Martin and Ryan Goldberg. Prosecutors say the trio worked together to deploy the BlackCat (also known as ALPHV) ransomware against US companies throughout 2023, and in one attack extorted about $1.2 million, which they split three ways after laundering the money. BlackCat operates as a ransomware-as-a-service scheme, renting its file-encrypting malware to affiliate hackers for a cut of the proceeds; the same ransomware was used in the February 2024 Change Healthcare breach that exposed the sensitive medical and billing data of more than 192 million people, though those affiliates were never identified.