Ransomware Recovery Company Accused of $19 Million Fraud

October 26, 2026 | Wolf Radio Technology & Consumer News

Imagine turning on your computer one morning and discovering that every important file is locked. Your business records, customer information, photographs, and documents are suddenly inaccessible.

A message appears demanding money to unlock everything.

This is called a ransomware attack, and it can be devastating for individuals, businesses, hospitals, and even police departments.

Now imagine hiring a professional cybersecurity company to recover your files, only to discover that the company you trusted may have been taking advantage of your situation.

That's exactly what federal prosecutors allege happened in a case involving a Florida-based computer recovery business.

Cybersecurity CEO Faces Federal Fraud Charges

Zohar Pinhasi, the CEO of MonsterCloud, a Florida company specializing in ransomware recovery, has been indicted on federal fraud charges.

According to the U.S. Department of Justice, Pinhasi allegedly misled customers into believing his company could recover their encrypted computer files without paying the criminals responsible for the attacks.

Prosecutors say the company instead paid the hackers to obtain the information needed to unlock the files, then billed customers substantially more than the ransom payments.

Federal investigators allege the operation collected more than $19 million from customers, while paying more than $8 million to ransomware attackers.

In one particularly striking example, investigators claim a ransom payment of approximately $8,200 resulted in a customer being charged roughly $150,000.

Pinhasi has pleaded not guilty. If convicted, he could face up to 20 years in prison.

Victims May Have Been Taken Advantage of Twice

Ransomware attacks already put victims in a terrible position.

Cybercriminals encrypt important files and demand payment, often in cryptocurrency, before providing a key that may unlock the data.

Businesses facing these attacks can lose access to accounting records, customer databases, scheduling systems, and other information necessary for daily operations.

Many victims turn to professional recovery companies because they don't want to negotiate with criminals.

In this case, federal authorities allege that customers were led to believe MonsterCloud had special methods for recovering encrypted data without paying hackers.

Instead, investigators say the company was secretly making ransom payments and charging customers substantial fees.

The allegations raise serious questions about transparency in the computer recovery industry.

Warning Signs Were Reported Years Earlier

The allegations did not come completely out of nowhere.

In 2019, investigative news organization ProPublica published an investigation examining ransomware recovery companies, including MonsterCloud.

The investigation found that some companies advertising specialized recovery capabilities were actually paying hackers to unlock customers' files.

The companies sometimes described their recovery techniques as proprietary technology or confidential methods.

Customers often had no way to independently verify what was happening behind the scenes.

Some of MonsterCloud's customers reportedly included law enforcement agencies that specifically wanted to avoid paying criminals.

The new federal indictment brings renewed attention to those earlier findings.

What Is Ransomware, and How Does It Work?

Ransomware is malicious software designed to block access to computers or important information.

A typical attack may begin when someone opens a dangerous email attachment, clicks a malicious link, or unknowingly installs infected software.

Once the ransomware gets into a computer or network, it can encrypt files, making them unreadable without a special decryption key.

The attackers then demand payment in exchange for that key.

However, paying the ransom does not guarantee that your files will be recovered.

Even when criminals provide a working key, the computer system may remain compromised, and sensitive information may already have been stolen.

How to Protect Yourself or Your Business

Fortunately, there are practical steps that can significantly reduce the damage caused by ransomware.

1. Keep reliable backups.

Maintain regular backups of important files. At least one backup should be offline or otherwise protected from changes by an infected computer.

2. Be careful with unexpected emails.

Avoid opening unfamiliar attachments or clicking suspicious links, even when a message appears to come from a legitimate business.

3. Keep your computers updated.

Install operating system, browser, and software security updates to address known vulnerabilities.

4. Use reputable security software.

Modern antivirus and endpoint protection programs can help identify and block many common threats.

5. Protect your accounts.

Use strong, unique passwords and enable multifactor authentication wherever possible.

6. Research recovery companies before hiring them.

Ask how the company plans to recover your information, whether it intends to communicate with attackers, and whether ransom payments are included in its proposed solution.

Request written explanations of the services, fees, and recovery limitations.

7. Have an emergency plan.

Businesses should know who to contact if their systems are compromised. Having a response plan can prevent confusion and expensive mistakes.

What Should You Do if Your Computer Is Infected?

If you suspect ransomware has infected your computer, avoid rushing into a payment or hiring the first company promising an immediate solution.

Disconnect affected equipment from networks when it is safe to do so, and contact a qualified cybersecurity professional.

Businesses should also consider reporting the incident to the FBI's Internet Crime Complaint Center at IC3.gov.

Depending on the ransomware involved, legitimate security researchers may already have developed free recovery tools.

The No More Ransom Project provides information and decryption tools for certain ransomware infections.

Not every infection can be reversed, but it is worth checking before assuming that paying criminals is the only option.

The Bigger Lesson: Know Who You're Trusting With Your Computer

Computer problems are stressful enough without worrying about whether the people hired to help are being truthful.

This case is a reminder that expensive services and impressive advertising do not automatically guarantee honesty or technical expertise.

Whether you're a homeowner trying to recover family photographs or a business owner attempting to restore critical records, ask questions before handing over your computer, personal information, or money.

A trustworthy computer professional should be willing to explain the available options, the risks involved, and what you can reasonably expect.

At Wolf Radio, we believe understanding technology is one of the best ways to protect yourself from scams, security threats, and costly computer problems.

Have a computer question or a technology problem you'd like us to discuss?

Visit WolfRadio.net and submit your question for The Digital Den, our computer help and technology talk show.

Sources and Further Reading

This article is an original Wolf Radio news summary based on reporting by Renee Dudley of ProPublica and information released by the U.S. Department of Justice.

The charges described in this article are allegations. The defendant is presumed innocent unless and until proven guilty in court.

Ransomware Recovery Company Accused of $19 Million Fraud | Wolf Radio