Cybersecurity CEO Indicted for Allegedly Scamming Millions From Ransomware Victims
Zohar Pinhasi, the former CEO of Florida-based cybersecurity firm MonsterCloud, has been indicted on federal charges for allegedly defrauding millions of dollars from ransomware victims. According to the Justice Department, Pinhasi claimed he could recover encrypted files without paying hackers, but in reality, he paid the ransoms and charged clients additional fees. This legal action aligns with findings from a 2019 ProPublica investigation titled 'The Trade Secret,' which alleged that Pinhasi misled clients about his methods to extract profits. U.S. Attorney Joseph Nocella stated that the prosecution aims to hold accountable those who exploit ransomware attacks for personal gain. Pinhasi, who used the alias Zack Green, previously described his specific data recovery techniques as a trade secret during interviews with ProPublica. He has pleaded not guilty to the federal charges, and attempts to reach him or his representatives for comment were unsuccessful.
Zohar Pinhasi, a Florida resident and former executive of a cybersecurity firm, was indicted last month on federal charges alleging he defrauded ransomware victims of millions of dollars. The Justice Department stated that Pinhasi, who operated under the alias Zack Green, claimed to recover encrypted files without paying hackers. In reality, prosecutors allege he paid the ransom demands and charged clients substantial fees on top of those costs. Federal investigators determined that Pinhasi collected more than $19 million from clients while paying out over $8 million in ransom payments during the scheme. The indictment aligns with findings from a 2019 investigative report that detailed the operations of Pinhasi’s company, MonsterCloud. That earlier inquiry revealed that the firm misled clients, including local law enforcement agencies, by promising data recovery without engaging with criminal hackers. Many clients selected MonsterCloud specifically because they believed the firm would avoid paying ransoms. In specific instances, Pinhasi made small ransom payments while charging clients significantly higher amounts. One cited example involved an $8,200 ransom payment paired with a bill to the client of approximately $150,000. U.S. Attorney Joseph Nocella issued a statement on October 7 describing the defendant’s actions as re-victimizing clients while extracting profit. Nocella added that his office intends to vigorously prosecute both ransomware attackers and individuals who profit from such criminal activity. An FBI official included in the same release characterized Pinhasi’s conduct as turning victims' crises into a personal profit center. The official emphasized the agency's commitment to holding accountable those who exploit individuals targeted by cyberattacks. Pinhasi previously told reporters in 2019 that MonsterCloud did not guarantee specific methods for data recovery. He described the internal processes as a trade secret and asserted that clients simply needed to wait for their data to return. At that time, Pinhasi identified himself as a former IT security intelligence officer for the Israeli military. He stated that the firm handled up to 30 daily inquiries and employed about 20 staff members in South Florida. Ransomware emerged as a major global cyberthreat around the time of the initial reporting, affecting governments, schools, and businesses. Attackers typically demanded payment in cryptocurrency to unlock seized data. Recent trends indicate that the threat landscape has evolved, with hostile foreign governments potentially using ransomware for espionage and artificial intelligence tools facilitating wider attacks. Pinhasi has pleaded not guilty to the federal charges. Attempts to contact him via mobile phone resulted in disconnected lines. Messages left with representatives at MonsterCloud’s office and with his legal counsel remained unanswered. If convicted, Pinhasi faces a maximum prison sentence of 20 years.
Go to the primary sources (3)
The official sources this coverage is built on. Read them directly to bypass framing.
Quest Diagnostics, a major medical laboratory testing company, disclosed via a regulatory filing that it suffered a cyberattack compromising patient personal and health data. The breach targeted the company's Quanum platform, which is used by approximately 500,000 clinicians to manage lab test requests, billing, and medical records. While Quest confirmed that certain patient records were accessed and notified law enforcement, the company has not specified the exact number of affected individuals or the precise types of data stolen. This incident adds to a series of significant cybersecurity attacks hitting the healthcare sector recently, including disruptions at Stryker, Boston Scientific, and McKesson. Quest's online security notice regarding the breach includes technical code that prevents search engines from indexing the page.
Bias read (Center): The article reports on a corporate cybersecurity incident involving a private entity. There is no indication of partisan framing, political advocacy, or ideological bias in the reporting. The tone is factual and focuses on operational details and industry trends rather than political implications.
Why factuality (95): Accurately identifies the event, the specific system involved (Quanum/LSM), and the nature of the compromise (patient records). Correctly cites the SEC 8-K filing as the source of confirmation. Contextualizes the event within broader healthcare sector trends accurately.
Why objectivity (90): Maintains a professional, neutral tone typical of tech journalism. Presents the facts without sensationalism or bias, focusing on the operational impact and regulatory disclosures.
Zohar Pinhasi, the former CEO of Florida-based cybersecurity firm MonsterCloud, has been indicted on federal charges for allegedly defrauding millions of dollars from ransomware victims. According to the Justice Department, Pinhasi claimed he could recover encrypted files without paying hackers, but in reality, he paid the ransoms and charged clients additional fees. This legal action aligns with findings from a 2019 ProPublica investigation titled 'The Trade Secret,' which alleged that Pinhasi misled clients about his methods to extract profits. U.S. Attorney Joseph Nocella stated that the prosecution aims to hold accountable those who exploit ransomware attacks for personal gain. Pinhasi, who used the alias Zack Green, previously described his specific data recovery techniques as a trade secret during interviews with ProPublica. He has pleaded not guilty to the federal charges, and attempts to reach him or his representatives for comment were unsuccessful.
Bias read (Center): The article reports on a federal criminal indictment involving fraud and cybersecurity, which falls under the domain of law enforcement and public policy. The tone is objective and fact-based, relying heavily on official statements from the U.S. Attorney’s Office and previous investigative findings.
Why factuality (5): This article discusses a different individual (Zohar Pinhasi) and a different type of cybercrime (ransomware recovery scam) unrelated to the Quest Diagnostics breach. It shares no factual overlap with the primary source document.
Why objectivity (85): The writing style is objective and reports on legal proceedings neutrally, but it is irrelevant to the specific event defined by the primary source.
The Washington TimesParty-alignedCenterFactual: no official source document/info detectedObjective 90
A woman from Maryland has been indicted on 38 counts of fraud and theft related to the District of Columbia’s healthcare system. Prosecutors allege that she successfully obtained payments totaling $109,000 from the D.C. Department of Health Care Finance. The charges assert that these funds were issued for medical services that were never actually rendered. This legal action highlights ongoing efforts by federal and local authorities to combat financial irregularities within public health programs.
Bias read (Center): The article presents a straightforward criminal indictment involving a public agency. The language is strictly factual, citing specific dollar amounts and charge counts without using emotionally charged adjectives or attributing broader political motives to the incident. It reads as standard crime/c
Why factuality: no official source document/info detected
Why objectivity (90): The tone is neutral and journalistic regarding the specific crime described, but since it covers the wrong event entirely, it offers no perspective on the actual incident.
How each side covered it
The same event, grouped by the political lean of the outlets covering it.
progressive
center
conservative
★
How each side covered it
Support independent, bias-aware news and unlock the social pulse, community voting, and every other Supporter feature.
United States
