The Recovery Firm Billed $19 Million. Prosecutors Say It Was Paying the Hackers.

01 What prosecutors say MonsterCloud did

The case turns on what MonsterCloud told its customers. Prosecutors say the firm advertised decryption techniques that recovered data without paying the attackers. They allege it had no such technology. Staff contacted the ransomware operators, bought the decryption keys and used them to restore the files. The indictment also alleges the firm showed victims decrypted sample files, obtained from the attackers, as “recovery proofs” of its own ability [ BleepingComputer ] .

Some contracts did mention contact with attackers. According to the indictment, they said MonsterCloud would deal with the attackers only if it could not decrypt the files by other means. Prosecutors say that dealing with the criminals was usually the first step [ Hackread ] . The US Attorney, Joseph Nocella Jr., said the defendant “re-victimized his clients” by claiming to decrypt ransomware without paying off the attackers [ EDNY ] .

None of this is new as a suspicion. In 2019 ProPublica reported that some recovery firms paid attackers while selling something else. The researcher Fabian Wosar built his own ransomware, posed as a victim, and traced the anonymous payment offers that reached his fake attacker back to MonsterCloud and another firm, Proven Data. At the time Pinhasi denied misleading customers and called the firm’s methods a trade secret [ BleepingComputer ] . The 2026 indictment is the first time prosecutors have put the allegation in front of a court.

02 Two invoices, two markups

Prosecutors gave two examples. Both are allegations, and both show how little a victim can see from inside an incident.

Figures from the indictment as reported by BleepingComputer [ BleepingComputer ] . Markups are our arithmetic on those figures.

Read the first row as a victim would have lived it. The systems are down. A firm says it can decrypt without paying, and sends back a decrypted file to prove it. The quote is $150,000. Nobody in the room can test the claim, because the claim and the proof come from the same supplier. Prosecutors say the real cost of the keys was about $8,200, and the victim never saw that number.

We see the same blind spot in incident response planning across the firms we test. Most UK organisations we work with have a backup policy and an insurer’s phone number. Very few have decided in advance who will negotiate, whether a payment is allowed at all, and what evidence they will demand before they believe a decryption claim. That gap is where a dishonest provider makes money, and where an honest one loses hours.

03 Paying a ransom in the UK in 2026

In the UK the official position has been consistent for years. In July 2022 the NCSC and the ICO wrote to the Law Society after seeing solicitors advise clients to pay. The NCSC said it does “not encourage or condone paying ransom demands to criminal organisations”. The Information Commissioner, John Edwards, said a payment “certainly does not reduce the scale or type of enforcement action from the ICO” [ NCSC, 2022 ] . The ICO gives credit instead to organisations that report to the NCSC and learn from the incident.

The law is catching up. In July 2025 the Home Office published its response to a consultation on three proposals: a ban on ransomware payments by public sector bodies and regulated critical national infrastructure, a requirement for other victims to notify the government before paying, and mandatory incident reporting [ Home Office, 2025 ] . Respondents backed the targeted ban by 72% to 23%, and 75% said a 72-hour reporting window was reasonable. As of February 2026 all three were still proposals in development, expected to align with the Cyber Security and Resilience Bill, with no commencement date [ Goodwin, 2026 ] .

The MonsterCloud case shows why the notify-before-pay idea matters. A victim that has to tell the government before paying has to know that a payment is happening. MonsterCloud’s clients, on the prosecution’s account, did not. Any provider you appoint should be contractually unable to pay an attacker on your behalf without your written instruction.

04 Vet the recovery firm before the attack

The cheapest protection is a decision made on a calm day. The NCSC assures incident response firms under its Cyber Incident Response scheme. Level 2 providers are assessed as able to handle the common attacks most organisations face, ransomware included, and you can search them on the NCSC website [ NCSC, 2023 ] . Pick one, agree terms, and put the name in your incident plan.

The last item decides the rest. A company that can restore from its own backups negotiates from strength or does not negotiate at all. A company that cannot is at the mercy of the first person who claims a way out. Do you know which one you would be on the morning it happens?