Data Recovery CEO Indicted for Allegedly Scamming Ransomware Victims

Cybersecurity CEO Indicted for Allegedly Scamming Millions From Ransomware Victims A federal grand jury indicted MonsterCloud CEO Zohar Pinhasi last month for allegedly defrauding clients of his ransomware data recovery business, which was the subject of a 2019 ProPublica investigation. A Florida man who was the subject of a 2019 investigation by ProPublica was indicted last month on federal charges that he defrauded clients of his ransomware data recovery firm. According to the Justice Department, the man, Zohar Pinhasi, told customers he could recover their encrypted files without having to pay hackers, when, in reality, he paid the ransom and charged victims a hefty fee on top. The indictment mirrors the findings from ProPublica’s 2019 article “The Trade Secret,” which centered on Pinhasi and his scheme. The outlet found that the ransomware victims were being harmed twice: once by the hackers, who locked their targets’ files and demanded ransom, and a second time by MonsterCloud, Pinhasi’s Florida-based data recovery firm, which misled its clients about not paying ransoms. Read More “By falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself,” U.S. Attorney Joseph Nocella said in an Oct. 7 press release. “Our Office will vigorously prosecute ransomware attackers who prey on Americans from across the world and those who cynically profit from their criminal activity.” When ProPublica published its story in 2019, ransomware was growing into one of the world’s most pervasive cyberthreats. Hackers locked the data of governments, schools and businesses, holding the decryption key for a ransom payment, which they usually demanded in bitcoin and other types of difficult-to-trace cryptocurrency. ProPublica’s reporting focused on how U.S. industries, from data recovery firms like MonsterCloud to insurance giants that cover ransom payments, all fueled the extortion economy. Ransomware remains a widespread threat today, and the threat to national security has grown as hackers linked to hostile foreign governments are believed to use ransomware as a cover for espionage. The prevalence of AI tools is also making it easier for attackers to spread ransomware. Pinhasi, who went by the alias Zack Green, told ProPublica in 2019 that MonsterCloud never promised clients that their data will be recovered by any particular method. “How we do it, it’s our problem,” he told ProPublica. “You will get your data back. Sit back, relax and enjoy the ride.” He called MonsterCloud’s data recovery methods a “trade secret.” Pinhasi hung up when reached on his cellphone this month. A message left with a representative at MonsterCloud’s office phone number and a message left with his attorney were not returned. A spokesperson for the U.S. Attorney’s Office said Pinhasi pleaded not guilty to the federal charges. In its 2019 investigation, ProPublica interviewed MonsterCloud’s clients and ransomware experts and found that in certain cases the firm must have paid ransoms on behalf of clients. MonsterCloud’s services were particularly popular with local law enforcement agencies, who are loath to engage with or pay criminal hackers. Several interviewed by ProPublica at the time said they chose MonsterCloud to help them recover from ransomware because they believed the firm would never pay a ransom. Pinhasi, who described himself to ProPublica as a former IT security intelligence officer for the Israeli military, said in 2019 that MonsterCloud handled up to 30 calls a day and had about 20 employees in South Florida as well as extensive global contacts. Federal investigators found that, over the course of the scheme, Pinhasi allegedly charged clients more than $19 million and paid more than $8 million in ransom payments. In one example, Pinhasi made a ransom payment of about $8,200 but charged the client about $150,000. If convicted, he faces up to 20 years in prison. In the Justice Department’s October press release, an FBI official said Pinhasi had “turned the victim’s crisis into his own profit center. This deception is unacceptable, and the FBI is committed to ensuring accountability for those who choose to victimize the very people who trusted them for help.” The Justice Department did not address ProPublica’s 2019 finding that one of the FBI’s own was among Pinhasi’s associates at MonsterCloud. John Pistole, a former deputy director of the FBI under Robert Mueller, was prominently featured in a promotional video on MonsterCloud’s homepage. “Police departments, government agencies, hospitals, small business and Fortune 500 firms trust MonsterCloud to help recover from attacks and protect against new ones,” Pistole said in the video. “MonsterCloud’s proprietary technology and expertise protects their professional reputations and organizational integrity.” Pistole was not mentioned by name in the Pinhasi indictment. In 2019, Pinhasi touted MonsterCloud’s ties to law enforcement as evidence of its integrity. Pistole, who also headed the Transportation Security Administration under President Barack Obama, was listed on MonsterCloud’s website as the only member of its “Cyber Security Advisory Council.” Pistole did not respond to a request for comment for this story. In a 2019 interview, he said he became acquainted with Pinhasi after MonsterCloud reached him through a speaker’s bureau and that MonsterCloud paid him indirectly through that group. He said Pinhasi scripted his testimonial and that he was well aware that in most cases — including MonsterCloud’s — the only way to decrypt data locked by ransomware is to pay the hackers. “That’s the business model as I understood it,” Pistole told ProPublica at the time. “Based on my experience and knowledge, ransom is paid and they facilitate the best practices moving forward.” A spokesperson for the U.S. Attorney’s Office declined to comment on Pistole’s connection to MonsterCloud. Contributors Renee Dudley X Bluesky LinkedIn I am a ProPublica reporter focused on technology, cybersecurity and business. Have a Tip for a Story? I’m interested in the intersection of Big Tech and national security. If you’ve worked in tech or government, or otherwise have tips about this area, please get in touch. Renee Dudley X Bluesky LinkedIn I am a ProPublica reporter focused on technology, cybersecurity and business. I’m interested in the intersection of Big Tech and national security. If you’ve worked in tech or government, or otherwise have tips about this area, please get in touch. Republish This Story for Free Creative Commons License (CC BY-NC-ND 3.0) Thank you for your interest in republishing this story. You are free to republish it so long as you do the following: You have to credit ProPublica and any co-reporting partners. In the byline, we prefer "Author Name, Publication(s)." At the top of the text of your story, include a line that reads: "This story was originally published by ProPublica." You must link the word "ProPublica" to the original URL of the story. If you're republishing online, you must link to the URL of this story on propublica.org, include all of the links from our story, including our newsletter sign up language and link, and use our PixelPing tag. If you use canonical metadata, please use the ProPublica URL. For more information about canonical metadata, refer to this Google SEO link. You can't edit our material, except to reflect relative changes in time, location and editorial style. (For example, "yesterday" can be changed to "last week," and "Portland, Ore." to "Portland" or "here.") You cannot republish our photographs or illustrations without specific permission. Please contact [email protected]. It's okay to put our stories on pages with ads, but not ads specifically sold against our stories. You can't state or imply that donations to your organization support ProPublica's work. You can't sell our material separately or syndicate it. This includes publishing or syndicating our work on platforms or apps such as Apple News, Google News, etc. You can't republish our material wholesale, or automatically; you need to select stories to be republished individually. (To inquire about syndication or licensing opportunities, contact [email protected].) You can't use our work to populate a website designed to improve rankings on search engines or solely to gain revenue from network-based advertisements. We do not generally permit translation of our stories into another language. Any website our stories appear on must include a prominent and effective way to contact you.