Angelo Martino, a former employee of DigitalMint, was sentenced to 70 months in prison for involvement in BlackCat ransomware attacks against U.S. companies between April 2023 and April 2025. Alongside two other former ransomware negotiators, Martino acted as a BlackCat affiliate, demanding ransom payments and threatening data leaks. They paid 20% of ransom proceeds to BlackCat administrators for ransomware access. Martino exploited confidential negotiation information from victims to maximize extortion amounts. Victims included financial services firms, nonprofits, school districts, medical facilities, and law firms. DigitalMint condemned and terminated the employees after uncovering their criminal conduct.

The attacks resulted in significant financial losses to at least five U.S. organizations, including ransom payments exceeding $25 million by some victims. The insider knowledge shared by the former negotiators enabled the attackers to demand maximum ransom amounts, increasing the financial impact. The attacks also involved threats to leak stolen data, potentially causing reputational damage and operational disruption to the victims.

This incident involves criminal insider activity rather than a software vulnerability. DigitalMint terminated the involved employees immediately upon discovery. Organizations should ensure strict controls on insider access to sensitive negotiation and insurance information. No software patch or direct technical remediation applies to this threat. Monitoring for insider threats and enforcing separation of duties in ransomware negotiations are recommended.