A ransomware negotiator \u2014 someone hired by victims to fight hackers \u2014 was secretly feeding the hackers everything. Insurance limits. Internal negotiation strategy. Real-time positioning. The whole time.<\/p>\n
That’s not a hypothetical. Angelo Martino, a negotiator at Illinois-based DigitalMint, pleaded guilty in April 2026 to conspiring with the BlackCat\/ALPHV ransomware gang against five U.S. companies he was supposed to be protecting.\u00b9 He was joined by a second DigitalMint employee and a former incident response manager at cybersecurity firm Sygnia \u2014 three insiders, all on the wrong side.\u00b2 Total ransom payments across the scheme: over $75 million, with two individual payments exceeding $25 million each.\u00b3 Martino personally walked away with $10 million in assets before the DOJ seized them.\u2074<\/p>\n
A senior DOJ official told CNN the case is “groundbreaking” \u2014 and flagged that at least one additional incident response firm is under investigation right now.\u2075<\/p>\n
The DigitalMint case is the most visible version of a threat pattern that’s been escalating across accounting and financial services for 18 months.<\/p>\n
The attack surface has shifted. Hackers aren’t just targeting your firm directly \u2014 they’re moving through the platforms and providers you’ve already cleared to be inside your environment:<\/p>\n
This is the double extortion model: steal the data, lock the systems, then threaten to publish client financials and SSNs publicly if you don’t pay again. It’s now the standard playbook.\u2079<\/p>\n
Accounting and legal firms hold concentrated repositories of immediately monetizable data \u2014 Social Security numbers, tax returns, payroll records, full business financials across dozens of clients simultaneously. Criminals know your filing season calendar. They time attacks for maximum operational pressure, when downtime costs the most and your negotiating position is weakest.\u00b9\u2070<\/p>\n
The Gramm-Leach-Bliley Act Safeguards Rule now applies directly to CPA firms and tax professionals. The IRS audits firms on cybersecurity readiness when a breach or client complaint is reported.\u00b9\u00b9 Compliance isn’t a checkbox \u2014 it’s a live liability.<\/p>\n
You can have a solid firewall and still get hit through a vendor with admin access to your systems. Cybersecurity in 2026 means actively managing every third-party relationship that touches your environment \u2014 not just at onboarding.<\/p>\n
That’s where having a local IT partner changes the equation. When something goes wrong mid-tax season, you don’t need a national support line reading your ticket cold. You need someone who already knows your systems, your client data environment, and your risk profile.<\/p>\n
CMIT Solutions works with accounting firms, legal offices, and financial professionals across Cincinnati, Florence, and Covington \u2014 providing third-party vendor reviews, layered monitoring, documented incident response plans, and the staff training that keeps well-meaning employees from accidentally becoming the breach themselves.<\/p>\n
Call a local expert today or book a consultation<\/a> with a real human IT professional.<\/p>\n