What the MonsterCloud charging release alleges

What happened

On Wednesday, October 7, 2026, the Justice Department's Office of Public Affairs said Zohar Pinhasi, 50, a U.S. and Israeli national, was arraigned that day in the Eastern District of New York. The release says he is also known as Zack Silver and Zack Green, and that he owns MonsterCloud, a Florida company that offered ransomware remediation. He is charged with two counts of wire fraud and one count of wire fraud conspiracy. The release says a conviction would carry a maximum of 20 years on each count. It also says an indictment is an allegation and that a defendant is presumed innocent until proven guilty. The page filing the release is Futureweb.

What the indictment alleges

The release says the indictment alleges Pinhasi told distressed business owners that MonsterCloud could recover data without paying a ransom. It says the company's site cautioned clients not to pay, and that he represented access to proprietary tools and advanced decryption techniques. The allegation is that he had no such decryption technology. The release says he instead contacted the cybercriminals who had already hit the client, paid them for a decryption key, and had employees try to decrypt the files with that key. He then charged a fee the department calls substantially higher than the ransom. These are allegations. They are not findings after a trial. The desk is Security.

The amounts in the release

The release's headline says he allegedly paid cybercriminals more than $8 million in ransom payments while charging clients $19 million. The body says that over the course of the scheme he allegedly charged clients more than $19 million and paid more than $8 million in ransoms. It gives one example, in or around August 2023: a ransom of approximately $8,200 and a client fee of approximately $150,000. The Record and Help Net Security reported the same charging announcement. This page uses the department's figures and does not add a client list the release does not contain. How this desk files an advisory, a different kind of security document, is the advisory is the story.

Why it matters on this desk

The dependency is a fraud allegation about a recovery service, so the brief sits on the security desk. It is not a vulnerability advisory, and it is not a new ransomware family. The FortiBleed advisory filed the same day is a product warning about lockouts. This one is a charging document about what a vendor allegedly told a client. They share a desk and do not share a subject. What a CVE identifier is, which this indictment is not, is what a CVE identifier is.

What the department says about paying

In the same release, the department points to joint guidance from the FBI and CISA. It says those agencies do not recommend that ransomware victims pay a ransom. The release says paying does not ensure that data is decrypted, that systems or data will no longer be compromised, or that data will not be leaked. The FBI is investigating. Prosecutors named in the release are from the Computer Crime and Intellectual Property Section and the Eastern District of New York. None of that guidance is a how-to for moving a payment, and this page does not describe one. A privacy question about who holds a key is a different brief, on Privacy.

What the outlets agree on

The Record and Help Net Security frame the same Wednesday release: an owner of a recovery firm charged with wire fraud, an allegation that ransom was paid in secret, and a gap between the fee and the ransom in the department's example. They do not disagree, in the accounts this page is using, on the counts, the district, or the totals in the release. Where a detail is only in one outlet, this page leaves it out. The shared story is the charging document. The department's text is the primary one.

What to watch next

A superseding indictment, a plea agreement, or a verdict would replace the allegation with a later court result. The October 7 release describes the arraignment and the charges. It does not, in the text posted on justice.gov, state a plea. This page does not import a plea from a secondary headline. Until a court document says otherwise, the charges remain charges, and the presumption of innocence remains the department's own closing line.

What this page will not do

It will not treat the indictment as a conviction. It will not name a client the release does not name. It will not describe how a ransom was arranged, which payment rail was used, or which account received it. Those steps are not needed to say what the department charged. A reader who wants the allegations in the government's words can use the Office of Public Affairs link. A reader who wants a hearing color the release does not contain will not find it invented here.

What stays a charging document

What stays specific is an October 7, 2026 arraignment in the Eastern District of New York, two wire-fraud counts and one conspiracy count, an allegation about MonsterCloud fees versus ransoms, and the department's totals of more than $19 million charged and more than $8 million paid. It is not a finding of guilt. It is not a description of how to pay a ransom. The Record and Help Net Security reported the same release. The next document that matters is the court's, not another restatement of the headline.