Updated October 2, 2026: This case has progressed beyond the original charges. The Justice Department reported on April 30, 2026 that Ryan Goldberg and Kevin Martin were each sentenced to four years in prison for their role in an ALPHV BlackCat ransomware extortion conspiracy.
The previously linked court filing is retained for historical context. The later DOJ sentencing announcement is the source for the outcome summarized here.
Confirmed case timeline
- April–December 2023: The April 2026 DOJ announcement describes ransomware deployments against multiple U.S. victims during this period.
- December 2025: Goldberg and Martin pleaded guilty to conspiracy to obstruct, delay or affect commerce by extortion.
- April 30, 2026: DOJ announced the four-year sentences. A maximum possible statutory sentence in older coverage is not the sentence actually imposed.
DOJ identified both men as cybersecurity professionals and said they agreed to give ALPHV administrators a 20% share of ransoms in exchange for access to the ransomware and extortion platform. The sentencing announcement gives ages 40 and 36 respectively; the earlier ages in this article were incorrect.
The related negotiator case
In a separate April 20, 2026 announcement, DOJ described Angelo Martino’s guilty plea and his disclosure of confidential victim information to ransomware actors. That announcement is evidence of the plea and admitted conduct; it is not a final sentencing record. This article does not infer a later outcome from a scheduled hearing date.
What the evidence does not establish
The fact that defendants worked in cybersecurity does not prove they exploited privileged access at every victim or used a specific VPN flaw. The earlier version supplied detailed intrusion sequences and victim operational effects without adequately sourcing them. Those details have been removed rather than presented as court findings.
Keep ransomware-family behavior separate from facts proved in a particular prosecution. A general discussion of encryption, data theft or negotiation does not establish that every technique occurred at every victim in this case.
Practical lessons for organizations
The following are editorial control-review questions, not additional findings about the defendants or a new legal mandate:
- Who can see sensitive incident information? Review access to insurance information, negotiation positions and recovery plans. Limit access to those who need it and retain an access record.
- Who approves privileged actions? Check whether high-impact account, backup and configuration changes have appropriate oversight. Avoid unnecessary standing administrator access.
- Can backups be restored independently? Test a controlled restoration and document what credentials and systems it depends on. A backup that exists but cannot be restored is not a verified recovery plan.
- Who makes incident decisions? Record the escalation contacts, decision owners and evidence-preservation responsibilities before an incident. Coordinate operational changes with the response team.
Responding to suspected ransomware
Follow your incident-response procedure, preserve relevant evidence and involve qualified responders. Avoid making unsupported promises that paying a ransom will restore systems or prevent disclosure. For reporting, use the FBI Internet Crime Complaint Center or your established law-enforcement contact.
Related guidance: ransomware protection for critical infrastructure and our ransomware and critical-infrastructure defense guide.
Correction: Updated the case outcome and removed unsupported ages, campaign dates, technical case-study details, quotations, penalty assertions and predictions. Named case facts are attributed to the dated DOJ announcements.
