The U.S. Department of Justice announced on October 7, 2026 that MonsterCloud owner Zohar Pinhasi was arraigned in the Eastern District of New York on charges involving allegedly false representations about ransomware recovery. He faces two counts of wire fraud and one count of wire fraud conspiracy.
According to prosecutors, Pinhasi told prospective clients that MonsterCloud had proprietary tools and advanced techniques to decrypt files without paying cybercriminals. DOJ alleges he instead contacted attackers, paid for decryption keys and used those keys in attempts to restore clients' data.
The department alleges that clients were charged more than $19 million over the scheme while more than $8 million went to ransom payments. Its release cites one example in which an approximately $8,200 ransom payment was followed by an approximately $150,000 client charge. These are allegations in the case, not findings from a completed trial.
If convicted, Pinhasi faces a maximum penalty of 20 years on each count, according to DOJ. A statutory maximum is not a sentence already imposed.
The release also repeats FBI and CISA guidance against paying ransomware demands. Payment does not ensure successful decryption, prevent further compromise or guarantee that stolen data will not be leaked.
An indictment is merely an allegation. Pinhasi is presumed innocent unless and until proven guilty beyond a reasonable doubt. The current news is the arraignment and charges, not a conviction or a finding that every recovery company uses the alleged method.