Two Sentenced for ALPHV BlackCat Ransomware Crimes

The news cycle on ransomware and cybercrime took a definitive turn on April 30, 2026, when a federal court in the Southern District of Florida handed down four-year prison terms to Ryan Goldberg and Kevin Martin for their roles in a conspiracy to obstruct commerce through extortion related to ALPHV BlackCat ransomware attacks in 2023. The sentencing, delivered by the U.S. Attorney’s Office for the Southern District of Florida, marks a high-profile enforcement milestone in the United States’ ongoing effort to disrupt the ALPHV/BlackCat ecosystem and to deter individuals who misuse cybersecurity expertise to harm American businesses. The event adds a concrete data point to a broader narrative about accountability for ransomware affiliates and insider participants, and it comes against the backdrop of prior DOJ actions that disrupted BlackCat’s operational infrastructure in December 2023. The sentencing also foreshadows forthcoming actions, including the pending sentencing of Angelo Martino, a third co-conspirator, later in 2026. (justice.gov) (justice.gov) (justice.gov)

This ALPHV BlackCat ransomware sentencing is part of a broader, data-driven effort to map and curb a ransomware ecosystem that has, over several years, leveraged as-a-service models to maximize harm and profits for operators and affiliates alike. The April 30, 2026 decision reflects the court’s assessment of the scale and the real-world damage caused by the group’s activities, including the theft and leakage of sensitive information and the disruption of essential services for victims across the United States. As the case unfolds, the implications extend beyond the four-year terms themselves, contributing to a growing body of jurisprudence on how prosecutors pursue conspiracy, extortion, and cyber-enabled crimes that cross multiple jurisdictions. The public record surrounding this sentencing, including the prior guilty pleas of Goldberg and Martin and the forthcoming sentencing of Martino, offers a rare, clearly dated snapshot of how law enforcement and the judiciary are tackling sophisticated ransomware operations in real time. (justice.gov) (justice.gov)

What Happened

The sentencing event and who was involved

On April 30, 2026, Ryan Goldberg, 40, of Georgia, and Kevin Martin, 36, of Texas, were each sentenced to four years in federal prison for their roles in a conspiracy to obstruct, delay or affect commerce through extortion in connection with ALPHV BlackCat ransomware attacks in 2023. The U.S. Attorney’s Office for the Southern District of Florida reported the sentences as the culmination of a case that also involved a third co-conspirator, Angelo Martino, 41, of Land O’Lakes, Florida, whose sentencing was scheduled for July 9, 2026. The court documented that all three men employed their cybersecurity expertise to facilitate the ransomware operation, including agreeing to a 20% share of any ransoms in exchange for access to the ALPHV BlackCat infrastructure and extortion platform. Goldberg and Martin were said to have extorted at least one victim for approximately $1.2 million in Bitcoin and to have laundered the proceeds through multiple channels. The case number, 25-cr-20443, anchors the proceedings in this district. The sentencing took place against a backdrop of more than a thousand victims worldwide impacted by ALPHV BlackCat. The SD Fla press release also notes that the broader network leveraged a ransomware-as-a-service model in which developers created and updated the malware, while affiliates targeted high-value victims. (justice.gov)

Timeline and key facts that shaped the ruling

The defendants’ path to sentencing is well documented in the public record. In December 2025, Goldberg and Martin each pled guilty to one count of conspiracy to obstruct, delay or affect commerce or the movement of any article or commodity in commerce by extortion, setting the stage for the four-year sentences handed down in April 2026. The plea admissions outlined the defendants’ involvement in deploying ALPHV BlackCat against U.S. victims between April and December 2023, and their agreement to share ransoms and launder proceeds. The plea and sentencing chronology demonstrates a deliberate, phased approach by prosecutors: initial disruption and charges in late 2023, guilty pleas in 2025, and final sentencing in 2026. This sequence is consistent with the U.S. Department of Justice’s broader strategy to disrupt the BlackCat operation and deter future affiliates. (justice.gov)

Background on the ALPHV/BlackCat operation and prior actions

The DOJ’s public record on BlackCat/ALPHV demonstrates a long arc of law enforcement actions designed to disrupt the ecosystem and to provide relief to victims. In December 2023, the Department announced a disruption campaign in partnership with the FBI and international authorities, including the deployment of a decryption tool that helped hundreds of victims restore systems and avoid paying millions in ransoms. The campaign illustrated the government’s willingness to use technical measures in tandem with prosecutions to reduce the impact of ransomware. The April 30, 2026 sentencing sits within this continuum of disruption and accountability. For historical context on the 2023 disruption, see the DOJ’s December 19, 2023 press release and related materials. (justice.gov)

What the numbers tell us about scale and impact

The SD Fla release notes that ALPHV BlackCat targeted more than 1,000 victims worldwide, underscoring the breadth of the operation and the challenges courts face when adjudicating cases involving extortion that spans multiple jurisdictions and victim profiles. The four-year sentences for Goldberg and Martin reflect a significant, though not unprecedented, penalty level for conspiracies to obstruct commerce through extortion in this context. The case highlights how affiliates with cybersecurity training can cross from defense to offense in cyberspace, leveraging technical know-how to maximize financial gain and harm. The record also notes that the law enforcement response included cross-agency collaboration, with the FBI leading the investigation and support from federal and international partners. (justice.gov)

The role of plea agreements in shaping outcomes

The guilty pleas filed on December 30, 2025, for Goldberg and Martin reflect the government’s use of plea bargaining to secure accountability in a high-profile cybercrime case. The department stated that the defendants faced a maximum penalty of 20 years in prison per defendant, a statutory ceiling that framed the sentencing. The combination of guilty pleas and subsequent sentencing illustrates how plea agreements can accelerate accountability and close loops more efficiently than full trials in complex, technically intricate cases. The December 2025 pleading is a critical data point in understanding how prosecutors approach ransomware cases that involve insider participants and affiliates. (justice.gov)

The broader context for policy and enforcement

Beyond the immediate court proceedings, the Goldbergs and Martins of the world operate within a broader policy and enforcement framework that emphasizes deterrence, disruption of infrastructure, and international cooperation. Law enforcement has consistently underscored that ransomware operations like ALPHV/BlackCat rely on a network of developers, affiliates, negotiators, and infrastructure providers who collectively create a risky and profitable ecosystem. The December 2023 disruption and the 2025–2026 prosecutions demonstrate that the government is pursuing multiple angles—technical disruptions, strategic disruption of criminal networks, and criminal accountability for participants at different levels of the chain. This multi-pronged approach is essential for addressing the evolving ransomware landscape, where attackers frequently switch tactics and jurisdictions. (justice.gov)

Why It Matters

A precedent for accountability in insider roles

The April 30, 2026 sentencing of Goldberg and Martin underscores a growing willingness by federal courts to hold insiders who leverage cybersecurity knowledge for extortion accountable through long-form prison terms. The defendants’ backgrounds as cybersecurity professionals who used their expertise in support of criminal activity highlight a broader policy question: to what extent should legitimate security skills be treated as a crime when used to facilitate wrongdoing? The SD Fla release frames the sentences as a warning to others who might navigate the gray areas of defensive work and offensive exploitation. This is particularly salient for the incident response and security consulting communities that sometimes operate near the boundary between defense and offense. The court’s decisions here contribute to a clearer delineation of permissible uses of cybersecurity expertise under U.S. law. (justice.gov)

Deterrence effects for the ransomware ecosystem

From a market and policy vantage point, the sentencing illustrates how prosecutions can shape the incentives for would-be affiliates. The core ALPHV/BlackCat model—ransomware-as-a-service with profit-sharing—depends on network participants who might otherwise consider illegal activity as a viable livelihood. When prosecutors pursue conspiracies to extort and when courts assign tangible prison terms, the perceived returns on such activities change. The public record of these cases, including the guilty pleas and subsequent sentencing, provides a concrete counterexample to the notion that such activities are low-risk, high-reward, a narrative that has historically attracted some affiliates. The DOJ’s timeline of actions related to ALPHV/BlackCat—culminating in 2026 with sentencing—offers a tangible measure of deterrence and enforcement. (justice.gov) (justice.gov)

Victims and victims’ families: a measured, human lens

The public statements from prosecutors emphasize that the harm to victims extends beyond financial losses. The release recalls patient data exposure and the operational disruption experienced by victim organizations, including those in medical and engineering services. While the financial penalties and incarceration are central to the legal process, the broader impact on people and organizations—patients, employees, and communities reliant on critical services—remains the core reason for these prosecutions. The court-mandated sentences reflect a balance between accountability and the practical need to deter harmful cyber activity while recognizing the complexities of cybercrime’s scale and reach. The record from April 2026 reiterates the measured approach that law enforcement aims to uphold when addressing sophisticated cyber threats. (justice.gov)

The role of law enforcement coordination and public-private collaboration

The cases around ALPHV/BlackCat illustrate a broad spectrum of collaboration among federal prosecutors, specialized cybercrime units, the FBI, and international partners. The April 2026 sentencing release attributes credit to multiple agencies and notes that the FBI’s field office in Miami led the investigation with assistance from the U.S. Secret Service. The 2023 disruption referenced in DOJ materials demonstrates how public-private partnerships, including incident response firms, can intersect with enforcement actions to mitigate risk and recover funds for victims. This collaborative framework is essential for countering sophisticated ransomware networks that span borders and industry sectors. (justice.gov) (justice.gov)

The broader policy backdrop and future implications

The sentencing aligns with a broader policy emphasis on disrupting cybercrime ecosystems through a combination of enforcement, intelligence-led operations, and international cooperation. The December 2023 disruption and later prosecutions show a persistent policy posture aimed at dismantling the infrastructure that underpins ALPHV/BlackCat, from developer teams to affiliate operators. As the court system continues to handle these complex cases, practitioners and policymakers will watch closely how sentences for insider participants influence the evolution of ransomware-as-a-service business models, negotiation dynamics, and the line between legitimate cybersecurity work and criminal collaboration. The public record demonstrates that prosecutors are intent on closing loopholes and reducing the profitability of ransomware operations by pursuing all levels of involvement. (justice.gov)

What’s Next

Martino’s sentencing and potential implications

Angelo Martino’s sentencing was scheduled for July 9, 2026, following his December 2025 guilty plea. The SD Fla release notes that his case stands alongside the Goldberg-Martin sentencing to illustrate the DOJ’s comprehensive approach to addressing all participants in the ALPHV/BlackCat ecosystem. Martino’s role as a negotiator who allegedly fed victim information to attackers adds a distinct dimension to the case, emphasizing how insider access and information leverage can magnify harm and complicate the legal process. If the court provides a substantial sentence for Martino, observers may assess how the three-entity dynamic—two defendants already sentenced, a third awaiting sentencing—shapes future prosecutions of ransomware affiliates and incident responders who cross into criminal activity. The official timeline remains a critical point of reference for analysts tracking the enforcement trajectory against BlackCat/ALPHV. (justice.gov) (justice.gov)

Potential regulatory and industry responses

In the wake of high-profile sentencing, regulatory and industry responses are likely to intensify focus on safer incident response practices, vendor risk management, and the ethical boundaries of cybersecurity work. Corporations and government contractors may reexamine their third-party risk frameworks, incident response protocols, and contractual language around ransomware negotiation services. The DOJ’s public-facing communications around the ALPHV/BlackCat cases—paired with ongoing investigations and international cooperation—offer a blueprint for how policymakers and industry players might collaborate to reduce the attack surface and improve resilience. The public record from December 2023 through April 2026 provides a continuous thread illustrating how enforcement, technical disruption, and information-sharing can work in tandem to curb the ransomware threat. (justice.gov)

Monitoring the next phase of the ALPHV/BlackCat prosecutions

As the legal process continues, observers will monitor Martino’s sentencing and any potential related cases that may arise from this operation. The evolving narrative around ALPHV/BlackCat will likely influence juries, prosecutors, and defense teams as they navigate the complexities of cybercrime statutes, plea bargains, and sentencing guidelines. The public record thus remains a critical resource for attorneys, researchers, and policymakers who seek to understand the practical implications of these cases for cybercrime enforcement and defense. (justice.gov)

Closing

The April 30, 2026 sentencing of Goldberg and Martin stands as a concrete, dated milestone in the fight against ALPHV/BlackCat-related crime. It demonstrates that even individuals who bring specialized cybersecurity expertise into a criminal enterprise can face meaningful prison terms, and it foreshadows further actions against other participants in the same ecosystem. The broader narrative—tied to the 2023 disruption and the ongoing legal actions that followed—shows a sustained commitment by U.S. authorities to disrupt ransomware operations, recover affected funds where possible, and deter future wrongdoing across borders. As Martino’s sentencing unfolds later in 2026, the industry will be watching closely to gauge how these decisions shape the incentives for current and prospective affiliates, negotiators, and support personnel who later consider stepping into the criminal realm. The public record offers a clear, dated arc from the earliest disruption to today’s courtroom outcomes, underscoring that accountability in cyberspace remains a high priority for law enforcement and the courts alike. (justice.gov)