Florida Cybersecurity Firm Head Charged With Scamming Victimized Businesses

A Florida man who held himself out as a cyberattack solutions expert paid off the attackers while keeping much larger sums for himself—creating a piggy-back type of cyber fraud scheme, a grand jury said in an indictment.

Zohar Pinhasi, the owner of the Miami-based MonsterCloud cyber security firm, was arraigned this week in New York after he was indicted on multiple fraud charges in September.

“As alleged in the indictment, by falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself,” U.S. Attorney Joseph Nocella Jr., said in a statement.

The indictment and prosecutors allege that when distressed business owners would contact MonsterCloud for help after a ransomware attack, Pinhasi said his company’s special software could unlock files without paying ransom to the criminals. Instead, he would pay the criminals a fee to obtain a decryption key, then charge the victimized businesses much more.

In one case, Pinhasi paid about $8,200 to a cybercriminal then charged the client $150,000—without revealing that he had simply paid the ransom amount, the indictment reads.

“As alleged, Zohar Pinhasi claimed to fix ransomware while never remediating the underlying threat. Instead, he turned the victim’s crisis into his own profit center,” said Assistant FBI Director James Barnacle.

Pinhasi, who has dual U.S. and Israeli citizenship, could not be reached for comment Thursday morning at MonsterCloud’s phone number. Pinhasi was scheduled for a bond hearing in September but was out of the country at the time, his attorney said in a letter to the federal court. It was unclear if he had posted bond or if he was in custody Thursday morning.

The indictment did not indicate if the victim businesses carried cyber insurance, or if insurers paid the fees or if the insurers may seek compensation in subrogation from Pinhasi. The U.S. Department of Justice could not immediately be reached for comment.