Picture the worst night of a client’s year. Files are encrypted or stolen, an extortion note is waiting, and the insurance hotline is handing you names. Within hours, a stranger will know the client’s backup status, how much cyber coverage it carries, and how badly it needs to be back online by Monday.
Most organizations spend more time vetting a new printer vendor than the people they let into that room.
A report this week shows why that’s a problem.
What’s being alleged
According to KrebsOnSecurity, federal investigators pursuing the ShinyHunters extortion group have identified executives at two ransomware negotiation firms who maintained “unusually close relations” with the group. Sources close to the investigation told Krebs that one U.S.-based executive at a large consulting firm is believed to have helped operate Shinywire, a now-defunct site that listed nearly 100 victim organizations and pressured them to pay.
The same sources said messages recovered from an arrested ShinyHunters suspect showed these executives “often knew the details about new ShinyHunters victims before the victims themselves had even learned of the breach.”
The status of each person matters, so here it is plainly:
The U.S. executive has not been named or charged. Krebs is withholding the name and the firm’s identity for that reason.
Edward Dubrovsky, a Canadian cybersecurity executive, was arrested by the FBI and charged with threatening to disclose stolen data and interfering with interstate commerce through extortion, according to court records. He has not been convicted, and the charges are allegations.
None of this is proven. But it isn’t the first time the people hired to help ransomware victims have been accused of working the other side.
A pattern, not a one-off
Earlier cases have already reached court:
Two former incident response professionals, one from Sygnia and one from DigitalMint, were each sentenced to four years in prison after pleading guilty to conspiracy to obstruct commerce by extortion, for carrying out BlackCat ransomware attacks against U.S. companies.
A third former DigitalMint negotiator, Angelo Martino, was sentenced to 70 months. Prosecutors said he shared victims’ insurance policy limits and negotiation positions with BlackCat operators while negotiating on those victims’ behalf. DigitalMint’s CEO said the company condemned the conduct and immediately fired both employees when it learned of it.
On October 7, the Justice Department charged the CEO of MonsterCloud with wire fraud and conspiracy. As Krebs summarizes the charging documents, he allegedly told customers he would remediate attacks without paying the hackers, then secretly paid ransomware groups $8 million while charging customers $19 million. Those charges are also unproven.
The takeaway isn’t that incident response firms can’t be trusted. The overwhelming majority do honest, hard work under brutal pressure, and some of them, like Coveware and Unit 221B, have drawn threats from ShinyHunters for advising victims not to pay. The takeaway is that this is a vendor relationship with privileged access to your client’s worst day, and it deserves the same scrutiny as any other vendor with that kind of access.
The incentive problem built into the industry
Even without criminal conduct, the economics can work against the victim.
Mark Camillo, CEO of CyberAcuView, an industry group founded by major cyber insurers, told KrebsOnSecurity that while some firms charge a flat retainer, those specializing in ransom payments tend to charge a percentage of the total ransom paid. He called that an inherent conflict of interest. “No one in the ecosystem should be profiting purely on the size of the ransomware transaction or payment itself,” he said.
Krebs also notes that not every response firm will help a client pay. Once a victim decides to pay, firms that refuse are often replaced by firms that will. That means the people advising on the most consequential decision of the incident may be the ones with the most to gain from one particular answer.
And paying doesn’t guarantee the problem ends. The FBI’s May 2026 public service announcement on ShinyHunters told people contacted by the group: “Do not send payment or respond to their demands.” Krebs points to PowerSchool, which reportedly paid a ransom after its 2024 breach, only for school districts to later receive new extortion demands using samples of the same stolen files. Nobody has alleged ShinyHunters was behind that second wave, but there’s no technical way to verify stolen data was actually deleted.
Why this lands on the MSP
When a client is hit, the MSP is usually the first call. You’re the one who knows the environment, holds the admin credentials, and has the logs. You’ll be on the bridge call when the outside firms join, and you’ll often be the one granting them access.
That makes you part of the vetting process whether you planned for it or not. The question is whether that vetting happens calmly, months ahead, or at 2 a.m. under an extortion deadline.
The playbook: pick the bench before the fire
1. Start at insurance renewal, not at the incident
Many cyber policies control which responders they’ll pay for. An Aon and Crawford cyber claims guide explains that some policies require panel vendors, others require prior written consent, and others only require that costs be reasonable and necessary. Going off-panel without approval can mean expenses are refused in whole or in part.
Attorneys at Smith Anderson recommend raising preferred counsel and vendors with the broker before coverage is bound, and getting approval in writing, ideally in the policy or an endorsement. Help each client find out:
Who is on the carrier’s panel for breach counsel, forensics, and negotiation
Whether the policy requires panel vendors or prior consent
Whether any responder the client already trusts can be pre-approved
2. Treat the panel as a starting point, not the due diligence
An insurer’s panel tells you who the carrier will pay. It doesn’t answer every question about who you’re letting in. Chubb, for example, notes that its pre-approved providers are independent contractors, not agents of Chubb, and that choosing one is the policyholder’s independent choice.
Before an incident, ask each candidate firm in writing:
How are you paid for negotiation? Is any fee tied to the size of a ransom payment?
What fees apply to the payment itself, including cryptocurrency conversion and exchange costs?
Do you facilitate payments, and if not, what happens if the client decides to pay?
How do you screen payments against sanctions lists?
What background checks do negotiators and responders go through?
Will you disclose any relationship your firm or its principals have with threat actors, leak sites, or other negotiators?
How do you coordinate with law enforcement?
A firm that answers clearly is a better partner. A firm that won’t answer is an answer.
3. Prefer fees that don’t reward a bigger ransom
Flat-fee or hourly pricing keeps the adviser focused on resolving the incident, not on the size of the payment. Camillo’s comments to Krebs point to the issue: percentage fees “may or may not be disclosed.” Get the full fee model in writing before you need it.
4. Pre-sign the agreements
Negotiating a contract during an active extortion is the worst possible time to read the fine print. Work with the client’s counsel to have retainers or master service agreements in place for the chosen responders. Marsh’s incident response guide notes it can help for the forensics firm to be retained through outside counsel to preserve privilege. That’s a legal question for the client’s lawyers, but it’s one to settle in advance.
Ask counsel to consider adding confidentiality terms, a written conflict-of-interest disclosure, and a duty to tell the client if the firm or its principals become the subject of an investigation.
5. Keep the payment decision in the client’s hands
Whether to pay belongs to the client’s leadership, counsel, and insurer, not to an outside intermediary. The Treasury Department’s Office of Foreign Assets Control (OFAC) advisory on ransomware payments warns that sanctions penalties apply on a strict liability basis, meaning a company can be held liable even if it didn’t know the recipient was sanctioned. OFAC also says the U.S. government strongly discourages paying ransoms and treats prompt reporting to, and cooperation with, law enforcement as significant mitigating factors.
Share information on a need-to-know basis, too. The Martino case is a reminder that a client’s insurance limits and negotiating position are exactly what an attacker wants to know. Don’t let any single intermediary become the only source of truth about the attacker, the stolen data, or the demand.
6. Write the MSP’s role down
Your responsibility matrix should say who calls the carrier, who engages breach counsel, who grants outside responders access, and who is never the negotiator. For most MSPs, that last one should be you. Your job is to preserve evidence, contain the damage, and support recovery, not to haggle with extortionists.
Then rehearse it. Run a tabletop that includes the uncomfortable moment when the client wants to pay and the forensics firm won’t help, so everyone knows what happens next.
Turn it into evidence
This work produces a record worth keeping. For each client, maintain an incident response vendor register:
Breach counsel, forensics, negotiation, and notification vendors, with contacts
Insurer panel status and any written pre-approvals
Contract or retainer dates
Fee model, including how negotiation is billed
Conflict-of-interest disclosures received
Date of last review and who signed off
That register supports the incident response plan, strengthens insurance renewals, and gives you a clear story for the next client meeting: when something goes wrong, we already know exactly who’s coming, what they cost, and whose side they’re on.
That’s the real question this week’s news raises. Not whether to trust incident responders, but whether you chose them before you needed them.
Frequently asked questions
Q: What is alleged about ransomware negotiators and ShinyHunters?
A: According to KrebsOnSecurity, federal investigators believe executives at two ransomware negotiation firms had unusually close ties to the ShinyHunters extortion group, and that one U.S. executive helped run its victim-pressure website. That executive has not been named or charged. Canadian executive Edward Dubrovsky has been charged with extortion-related offenses but not convicted.
Q: Should MSPs act as ransomware negotiators for their clients?
A: Generally, no. Negotiation is a specialized role that touches sanctions, insurance, and legal exposure. The MSP’s role is usually to preserve evidence, contain the incident, and support recovery, while the client, its counsel, and its insurer make payment decisions and engage approved specialists.
Q: Do I have to use my cyber insurer’s panel vendors?
A: It depends on the policy. Some policies require panel vendors, some require prior written consent for others, and some only require that costs be reasonable and necessary, according to an Aon and Crawford claims guide. The safest approach is to confirm requirements and get any preferred vendors approved in writing at renewal.
Q: Why are percentage-based ransomware negotiation fees a problem?
A: When a negotiator earns a percentage of the ransom paid, a larger payment means a larger fee. CyberAcuView CEO Mark Camillo told KrebsOnSecurity this is an inherent conflict of interest. Flat or hourly fees keep the adviser focused on resolving the incident.
Q: What questions should I ask an incident response firm before hiring it?
A: Ask how it bills for negotiation, what fees apply to any payment, whether it facilitates payments, how it screens for sanctions, what background checks its staff undergo, whether it will disclose relationships with threat actors or other negotiators, and how it works with law enforcement. Get the answers in writing before an incident.