Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Federal prosecutors accuse MonsterCloud LLC owner Zohar Pinhasi of telling customers the company could recover ransomware-encrypted data without paying attackers, while secretly paying attackers for decryption keys and charging clients substantially more. The alleged client charges exceed $19 million; the alleged ransom payments exceed $8 million. These are claims in a pending criminal case, not proven findings. Pinhasi is presumed innocent unless and until proven guilty.
What prosecutors allege
According to the U.S. Department of Justice, Pinhasi represented that MonsterCloud used “proprietary tools” and “advanced decryption techniques” to restore files without giving in to ransom demands. Prosecutors allege that he instead contacted attackers who had compromised clients, paid them for decryption keys, and directed MonsterCloud employees to try those keys on client files. The government says the company generally charged clients substantially more than the ransom payments.
As an Amazon Associate I earn from qualifying purchases.
The indictment is the court filing in United States v. Zohar Pinhasi, Eastern District of New York case 1:26-cr-00271-RER, Document 1. The DOJ’s announcement and the indictment describe the allegations; neither establishes guilt.
The amounts in the government’s account
The DOJ says Pinhasi charged clients more than $19 million and paid more than $8 million in ransom payments over the alleged scheme. Those are figures in the government’s announcement, not independently audited losses or amounts established after trial.
#1 Best Overall
As an example, prosecutors say that in August 2023 Pinhasi paid an attacker approximately $8,200 and charged one client approximately $150,000. The figures illustrate the alleged difference between a ransom payment and a client bill; they do not establish the amount any particular client ultimately lost.
Charges and case status
A federal grand jury in the Eastern District of New York indicted Pinhasi on September 23, 2026. The DOJ announced that he was arraigned in Brooklyn on October 7, 2026. As of that announcement, he faced two counts of wire fraud and one count of wire-fraud conspiracy.
The DOJ describes the maximum penalty as up to 20 years on each count if convicted. That is the statutory maximum cited in the announcement, not a prediction of a sentence. The charges remain allegations, and Pinhasi is presumed innocent unless and until proven guilty.
Why the alleged promise matters to ransomware victims
Paying an attacker for a decryption key is not the same as independently recovering data, and a key does not necessarily resolve the breach that led to encryption. The alleged conduct at issue is not simply that a recovery company may have used a ransom payment; prosecutors say the client-facing claim that recovery would happen without paying attackers concealed how the work was actually done.
Rank #3
The DOJ says joint FBI and CISA guidance does not recommend that ransomware victims pay. It warns that payment does not ensure data will be decrypted, systems or data will no longer be compromised, or stolen data will not be leaked. This is the DOJ’s summary of the guidance linked in its announcement.
Questions to ask a recovery provider
The allegations underline why customers should understand what a provider plans to do before authorizing work. These are practical evaluation questions, not a checklist attributed to prosecutors or regulators:
- What work will be performed? Ask whether recovery relies on backups, technical decryption, an attacker-provided key, or a combination.
- Could the provider contact or pay attackers? Ask whether negotiation or payment is contemplated, who makes that decision, and what written authorization is required.
- What does the quoted fee cover? Request a written breakdown of fees and any separate ransom payment, along with an explanation of how costs could change.
- Will the original intrusion be addressed? Ask what investigation, containment, and remediation are included so that restored systems are not simply returned to an unresolved compromise.
- How will evidence and limitations be handled? Clarify what records will be preserved, what data may be shared, and what the provider cannot guarantee about decryption, recovery, or exposure.
What is established—and what remains unresolved
The public account described here is based on the DOJ announcement and the linked indictment. The announcement gives the alleged conduct, amounts, charges, and procedural dates; the indictment is the formal charging document. The available information does not establish a conviction, an adjudicated loss amount, or later developments in the case.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
