BlackCat Ransomware: Two Cybersecurity Pros Jailed 4 Years

Two men who worked in the cybersecurity industry have been sentenced to four years each in federal prison for carrying out BlackCat ransomware attacks against organisations across the United States. Ryan Goldberg, 40, from Georgia, and Kevin Martin, 36, from Texas, deployed the ransomware between April and December 2023, targeting multiple victims and causing significant damage. The U.S. Department of Justice (DoJ) confirmed the sentences, sending a clear message that even people with cybersecurity knowledge are not above the law — and that ransomware remains one of the most serious digital threats facing businesses and ordinary people today.

Who Are These Two Men and What Did They Actually Do?

Ryan Goldberg and Kevin Martin were not your stereotypical basement hackers. Both held backgrounds in cybersecurity — the very field dedicated to protecting people from attacks like the ones they carried out. According to The Hacker News (followed by over 1.2 million people on LinkedIn and one of the most respected names in security reporting), the two men used the BlackCat ransomware — also known as ALPHV — to infiltrate the systems of multiple victims throughout the United States over an eight-month period in 2023.

Ransomware works by sneaking into a computer system, encrypting all the files so the owner cannot access them, and then demanding a payment — usually in cryptocurrency — in exchange for the decryption key. BlackCat was particularly dangerous because it was built using a sophisticated programming language that made it harder for traditional antivirus tools to detect. It was also offered as a “ransomware-as-a-service” tool, meaning attackers could license it from its creators and keep a share of the ransom money they collected.

Goldberg and Martin are believed to have been affiliates of the BlackCat operation — meaning they used the ready-made ransomware tool to run their own attacks while the original developers sat elsewhere and took a cut of the profits. This is sadly a very common business model in the criminal world today.

Why Should Everyday People Care About BlackCat Ransomware?

You might be thinking, “This sounds like a corporate problem — it won’t affect me.” But that thinking is exactly what scammers count on. Here is why this matters to regular people in the UK, USA, India, UAE, and Saudi Arabia alike.

When a hospital gets hit by BlackCat ransomware, patient records get locked. Surgeries get delayed. When a school is attacked, student data gets stolen. When a retail company’s systems go down, your order history, payment details, and personal information could be exposed or sold. The victims of ransomware attacks are not just the organisations — they are the customers, employees, and patients who trusted those organisations with their data.

India has one of the largest workforces in IT services globally, with millions of professionals working for or with American and European companies that run the exact kinds of systems these attackers targeted. Employees in the UAE and Saudi Arabia who work for multinational firms are equally exposed when a parent company’s systems are compromised. This is a global problem with very local consequences.

The fact that two people with cybersecurity expertise chose to turn their skills against the public also raises an uncomfortable question: if trained professionals can go rogue, how confident can we be in the systems meant to protect us? The answer is that no single layer of protection is enough — which is why knowing what you can do matters.

How BlackCat Ransomware Gets Into Systems — In Plain English

BlackCat typically gets into an organisation’s systems through one of a few common routes. The first is a phishing email — a fake message that tricks an employee into clicking a bad link or downloading an infected file. The second is exploiting weak or reused passwords to break into remote access systems. The third is taking advantage of unpatched software vulnerabilities, meaning security holes that a company has not yet fixed with an update.

Once inside, the ransomware quietly spreads across the network before activating — locking files and demanding payment, sometimes also threatening to publish stolen data publicly if the ransom is not paid. This double-pressure tactic has made BlackCat especially feared among organisations of all sizes.

The good news is that most of these entry points can be closed with basic, consistent security habits — no expensive software required. Our how-to guides cover many of these steps in detail, but here is what you and your organisation can do right now.

5 Things You Should Do Right Now to Stay Protected

1. Update your software today — not tomorrow. Ransomware frequently enters through known security holes in outdated software. Go to your device settings, check for updates, and install them. This applies to your phone, laptop, work computer, and any apps you use regularly. If your company’s IT team handles updates, email them and ask when the last update cycle ran.
2. Never reuse passwords across accounts. If a hacker gets your password from one leaked site, they will try it everywhere. Use a free password manager like Bitwarden or the built-in manager on your phone to generate and store unique passwords for every account. This one step closes one of the most common doors that ransomware affiliates use to break in.
3. Switch on two-factor authentication (2FA) wherever possible. This means that even if someone gets your password, they still cannot log in without a second code sent to your phone or generated by an app. Enable this on your email, banking, work accounts, and social media. It takes five minutes and dramatically reduces your risk.
4. Back up your important files — and keep the backup offline. If ransomware locks your files, a recent backup means you can restore everything without paying a ransom. Use an external hard drive that you disconnect after backing up, or a reputable cloud service. Make it a habit — weekly backups are a sensible minimum for most people.
5. Be suspicious of unexpected emails, even from known contacts. Phishing emails often look like they come from colleagues, banks, or delivery companies. Before clicking any link or downloading any attachment, check the sender’s actual email address carefully, and if in doubt, call the person directly to verify. Teach this habit to your family members and coworkers too.
6. Report suspicious activity immediately if you work in IT or handle company data. If something looks off — a file you cannot open, a programme running slowly, an account that logged in at a strange time — flag it to your IT or security team straight away. The faster ransomware is caught, the less damage it does. Do not wait and hope it goes away.

What This Sentencing Means Going Forward

The four-year prison sentences handed to Goldberg and Martin are significant because they show that law enforcement in the United States is now pursuing ransomware affiliates — not just the top-level developers — with real consequences. For years, many affiliates believed they could hide behind the anonymity of cryptocurrency and international borders. These convictions suggest that the walls are closing in.

However, BlackCat ransomware as a broader operation is not gone. Even after the FBI disrupted the BlackCat group’s infrastructure in late 2023, offshoots and copycat operations have continued to emerge. Cybersecurity researchers continue to monitor for new variants, and organisations around the world are urged to stay vigilant.

The lesson here is not to panic — it is to prepare. Two men have been held accountable, which is a positive development. But accountability after the fact does not undo the damage caused to victims. Prevention is always cheaper, easier, and less painful than recovery.

Bottom Line

Two cybersecurity professionals have been jailed for four years each for their role in BlackCat ransomware attacks — proof that insider knowledge does not make you untouchable, and that authorities are getting better at catching ransomware operators at every level. Whether you are an individual in India, a business owner in the UAE, or an employee in the UK or USA, the best thing you can do right now is update your software, back up your files, and turn on two-factor authentication. These simple steps put the odds firmly in your favour.