1 CEO Charged With Wire Fraud for Secretly Paying Hackers While Overcharging Clients

Federal authorities have charged Zohar Pinhasi, the owner of a ransomware recovery firm, with wire fraud. According to The Record, Pinhasi is accused of making secret ransom payments to hackers while simultaneously overcharging the victims of those attacks. The indictment suggests a systematic deception where clients believed they were paying for professional recovery services that would help them bypass direct payments to cybercriminals.

The risk

The allegations highlight a significant trust deficit within the incident response and recovery sector. Organizations facing ransomware attacks are often under extreme pressure to restore operations, making them vulnerable to bad actors who exploit their desperation. According to CyberScoop, Pinhasi allegedly deceived clients into a payment scheme that was disguised as a specialized service designed to help victims avoid paying cybercriminals. This creates a scenario where organizations believe they are mitigating financial loss and reputational damage through professional negotiation or technical recovery, only to find that funds are being diverted directly to attackers.

The core risk here is not just the malware itself, but the potential for fraud within the supply chain of recovery services. If a trusted vendor is secretly facilitating the very outcome they promised to prevent, the organization suffers a double loss: the ransom payment and the fees paid for the fraudulent "service." This undermines the integrity of third-party incident response providers and complicates the post-attack forensic and financial audit trails.

Who is exposed

Any organization that has engaged Pinhasi’s firm for ransomware recovery services is potentially exposed to these allegations. The victims were those who believed they were hiring a firm to help them avoid paying ransoms. According to CyberScoop, the CEO allegedly pocketed millions while executing this scheme. The exposure extends beyond the immediate financial loss to potential compliance violations, as paying ransoms can conflict with sanctions regulations and internal security policies. Companies that relied on these services to maintain compliance with data protection laws may now need to reassess their incident response logs and financial records.

Cost and compliance

The financial impact on the victims involves both the secret payments made to hackers and the overcharges levied by Pinhasi. According to The Record, the charges stem from the CEO allegedly making secret ransom payments while overcharging the victims of attacks. CyberScoop reports that Pinhasi allegedly pocketed millions through this deceptive scheme.

From a compliance perspective, organizations that unknowingly participated in ransom payments through this intermediary may face scrutiny regarding their adherence to anti-money laundering laws and sanctions regimes. The fraud also raises questions about the accuracy of incident reports filed by these victims, as the nature of the resolution—payment versus technical recovery—was misrepresented.

What should you do?

Business leaders should review their contracts with incident response and recovery vendors to ensure clear definitions of services and prohibitions on direct payments to attackers. Organizations should also verify the financial trails of any past ransomware incidents to ensure no unauthorized payments were made by third parties.

What to do and how to stay safe: Zohar Pinhasi

• Audit current contracts with incident response and recovery vendors to ensure explicit clauses prohibiting secret payments to threat actors.
• Review financial records from past ransomware incidents to verify that all payments made by third-party vendors were authorized and disclosed.
• Establish a pre-approved list of vetted incident response providers and require real-time reporting during active incidents.
• Implement strict financial controls that require executive approval for any payments made during a security incident, regardless of the vendor involved.

Step-by-step guide: Phishing Warning Signs: Spotting Attacks Before You Click

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who is Zohar Pinhasi?

Zohar Pinhasi is the owner of a ransomware recovery firm who has been indicted by federal prosecutors.

What is Pinhasi accused of doing?

He is accused of wire fraud for allegedly making secret ransom payments to hackers while overcharging victims.

Did Pinhasi claim to help victims avoid paying ransoms?

Yes, according to CyberScoop, he allegedly deceived clients into a scheme disguised as a service to help them avoid paying cybercriminals.