Data Recovery CEO Indicted for Allegedly Scamming Ransomware Victims

MonsterCloud CEO Zohar Pinhasi has been indicted on federal charges alleging that he defrauded customers seeking help after ransomware attacks. Prosecutors say he promised to recover encrypted files without paying hackers, but instead paid ransoms and charged clients much more, concealing how the recovery was done. Investigators allege he collected more than $19 million from customers and paid over $8 million in ransom. In one cited case, MonsterCloud paid about $8,200 to hackers and billed the client roughly $150,000. Pinhasi has pleaded not guilty; if convicted, he faces up to 20 years in prison.

The charges echo a 2019 investigation that found MonsterCloud’s business depended on paying ransoms despite presenting its methods as proprietary and attracting customers, including police departments, that wanted to avoid dealing directly with criminals. The case also highlights how recovery firms and other institutions can help sustain the ransomware economy, a threat that has since grown more serious and may be easier to spread using AI tools. MonsterCloud promoted its ties to law enforcement through a testimonial from former FBI deputy director John Pistole, who said he understood that ransom payments were generally necessary and that the company facilitated them. Pistole is not named in the indictment, and prosecutors declined to comment on his connection to the firm.