US authorities have announced criminal charges against the owner of MonsterCloud, alleging that the company billed ransomware victims more than $19 million while secretly paying the attackers for decryption tools and misrepresenting how data recovery was achieved. For European businesses, the case highlights a practical cybersecurity risk that can emerge during a crisis: relying on third-party recovery providers without enough transparency, contractual clarity, or technical oversight.

What happened

According to the U.S. Department of Justice, Zohar Pinhasi, described as a U.S. and Israeli national and the owner of MonsterCloud, has been charged in connection with an alleged scheme targeting organisations hit by ransomware.

Prosecutors allege that victims were told MonsterCloud could recover encrypted data using proprietary tools or legitimate recovery capabilities. Instead, the accusation is that the company secretly paid the ransomware operators to obtain decryptors, then charged customers substantial fees without disclosing that the attackers had been paid.

The charges are allegations, not a conviction. Based on the information released, the case centres on alleged fraud and misrepresentation in ransomware response services rather than on a new technical ransomware campaign.

Why it matters for European businesses

For companies in Europe, the case is relevant because ransomware incidents often create urgent decision-making under pressure. When operations are disrupted, businesses may turn quickly to external specialists for forensic support, negotiation, recovery, or decryption help. This case underlines that the service provider itself can become part of the risk.

There are several business implications:

• Vendor trust during incidents: A provider may present its work as technical recovery when the actual method involves contact with threat actors or ransom-related payments.
• Legal and compliance exposure: In some jurisdictions and sectors, payments linked to cyber extortion can create regulatory, sanctions, insurance, disclosure, or governance issues. Businesses need clear internal approval processes before any such step is taken.
• Insurance and reporting concerns: If a third party acts on a company’s behalf without transparent disclosure, that can complicate cyber-insurance claims, board reporting, audit trails, and incident documentation.
• Reputational and operational risk: If a business later learns that a provider misrepresented its methods, trust can be damaged internally and externally, especially in regulated or customer-facing sectors.

Although the charges were filed in the United States, the underlying lesson is relevant to European organisations that outsource cybersecurity response, especially SMEs that may not have in-house incident-response capacity.

Who may be affected

The issue is most relevant for organisations that may need outside help during a cyber incident, including:

• SMEs without a dedicated cyber incident-response team
• Mid-sized companies relying on MSPs, MSSPs, or external recovery vendors
• E-commerce and digital businesses where downtime has immediate revenue impact
• Regulated businesses that need documented incident handling and governance
• IT teams responsible for backups, business continuity, and ransomware response planning

It is also relevant for company leadership. Founders, finance teams, and operations leaders may be asked to approve urgent spending during an attack, often before all facts are known.

What companies should consider

• Review ransomware response providers: Ask prospective vendors to explain, in writing, what recovery methods they use, whether they ever engage with threat actors, and how customer approval is obtained for any sensitive action.
• Strengthen contractual safeguards: Contracts should define authorised actions, escalation requirements, reporting obligations, and billing transparency during incident response.
• Clarify internal approval rules: Establish who can approve negotiations, recovery spending, legal review, insurer contact, and any action that could amount to a ransom-related payment.
• Check insurer and legal requirements: Businesses should understand policy conditions, notification duties, and any sanctions or sector-specific restrictions that may apply before an external party acts on their behalf.
• Maintain tested backups and recovery plans: The stronger a company’s own recovery capabilities, the less pressure it faces to accept opaque emergency services during an incident.
• Document incident decisions: Keep records of vendor recommendations, approvals, actions taken, and technical findings for audit, legal, and post-incident review purposes.

The case does not establish new European legal requirements by itself. However, it is a useful warning for businesses to treat ransomware recovery procurement as a governance issue as well as a technical one.