The Justice Department charged Zohar Pinhasi, owner of Hollywood, Florida-based MonsterCloud, with wire fraud and wire fraud conspiracy on October 7, 2026. The indictment describes a transaction from around August 2023: MonsterCloud paid attackers $8,200 for a decryption key, then billed the client $150,000 to "recover" the same data. Prosecutors say the pattern repeated across roughly a decade in business, with over $8 million paid to attackers against more than $19 million billed to clients as remediation.
The claim nobody in the room could check
MonsterCloud's marketing said it specialized in recovering data "without succumbing to ransom demands," using proprietary tools and advanced decryption techniques. The DOJ's allegation is that none of that existed. The actual process was to quietly contact the attackers, pay the ransom, receive the key, and bill a large multiple of that price as if it were independent technical work.
That only functions as fraud if nobody checks. And in a live ransomware incident, nobody is positioned to check. The client is locked out of their own systems, running on a deadline measured in hours, and has no independent way to confirm whether a "decryption capability" is real, borrowed, or purchased from the same people who caused the problem. That asymmetry isn't a one-time lapse in judgment by a victim who should have known better — it's the normal condition of an incident response engagement, which is exactly why the scheme is alleged to have run for years at that scale without anyone inside a client organization catching it in real time.
The practice: make the vendor show its work, before the crisis
The fix has to be contractual, and it has to be in place before you need it, because there is no version of this where you negotiate evidentiary terms while a ransomware clock is running.
Three specific terms do the work:
A contractual right to forensic evidence of the recovery method, not just the outcome. That means the vendor logs and discloses, in writing, what decryptor was used, what command sequence ran against the affected systems, and whether the key came from a published decryptor, a known flaw in the ransomware's implementation, or a negotiated payment. "Your files are back" is not evidence. The log of how they got back is.
Ransom negotiation and incident response priced and billed as separate line items, with separate invoices. The MonsterCloud model worked because the markup had somewhere to hide — a single "remediation" invoice that could silently contain a ransom payment plus whatever multiple the vendor chose to add. A vendor who refuses to separate these two services, or who insists the ransom payment is proprietary and cannot be itemized, is asking you to trust the same number you can't verify.
A named third party who reviews the forensic report before final payment — typically outside counsel retained for the incident, since that relationship also preserves privilege over the findings. This is the step that actually catches a fabricated capability claim, because the vendor knows in advance that someone besides the panicked client will read the evidence.
The cost here is real: these terms add friction to a retainer negotiation that most organizations do once and then forget about, and some vendors will walk away rather than agree to show forensic evidence as a condition of payment. A vendor unwilling to put that in writing is giving you useful information before you ever have an incident. The same logic applies to verifying a vendors security patch notes — a claim about technical work has to be checked against evidence, not accepted because the vendor sounds confident. It's a different failure mode than auditing what an IT provider controls after their own console gets breached, but the underlying discipline is the same: know what a vendor actually does, and require proof rather than a promise.
What to check this week
- Pull your organization's incident-response retainer or MSA. Does it define how the vendor proves a recovery method, or only promise an outcome?
- Does the contract bill ransom negotiation and technical remediation as one line item or two?
- Is there a named reviewer — outside counsel or an independent forensic examiner — with the right to see evidence before the final invoice is paid?
- If your retainer is silent on all three, that's the gap, and it's cheaper to close now than mid-incident.
North InfoSec reviews incident-response vendor contracts and forensic evidence requirements as part of security assessments, including the kind of verification described above. northinfosec.com