U.S. Justice Department Investigates Former Ransomware Negotiator Over Alleged Misconduct

According to Cointelegraph, the U.S. Justice Department has initiated an investigation into a former ransomware negotiator accused of making deals with hackers to receive a portion of the cryptocurrency used in extortion payments. DigitalMint, a Chicago-based company specializing in ransomware negotiations, confirmed that one of its former employees is under criminal investigation and was terminated immediately upon the discovery of the allegations. DigitalMint President Marc Grens stated that the investigation pertains to alleged unauthorized actions by the employee during their tenure at the company. DigitalMint, which assists victims in negotiating and making payments to hackers, is not a target of the investigation. Grens emphasized that the company has been cooperating fully with law enforcement and took swift action to protect its clients once the allegations surfaced. He noted that trust is a daily commitment and that the company promptly communicated the facts to affected stakeholders. DigitalMint, registered with the U.S. Financial Crimes Enforcement Network, serves a client base that includes Fortune 500 companies and specializes in securely handling ransomware incidents. Recent data indicates a decline in ransomware payments, with a report from cyber incident response firm Coveware revealing that only 25% of companies targeted by extortion demands in the last quarter of 2024 paid the ransom. This marks a decrease from 32% in the third quarter of 2024 and 36% in the previous quarter. The trend suggests that more organizations are enhancing their cybersecurity measures, implementing better backup and recovery strategies, and resisting funding cybercriminals. Coveware also attributed the decline to increased law enforcement efforts and stronger regulatory guidance discouraging ransom payments. In a related development, the U.S. Treasury recently sanctioned Russia-based Aeza Group, its leadership, and a connected cryptocurrency wallet for allegedly hosting ransomware and information-stealing operations. Additionally, a report by blockchain analytics firm Chainalysis found that ransomware payments decreased by 35% to $815 million in 2024, down from $1.25 billion in 2023. Meanwhile, James Taliento, CEO of cyber intelligence services company AFTRDRK, highlighted concerns about ransomware negotiators not always acting in their clients' best interests, as they may be incentivized by the size of the ransom paid. A 2019 report by ProPublica also uncovered instances of U.S. firms paying hackers to retrieve stolen data and charging clients extra under the pretense of using specialized recovery methods.