The U.S. Justice Department is investigating a former employee of DigitalMint, a Chicago company that helps victims of ransomware attacks by handling hacker negotiations and cryptocurrency payments.
The ex-employee is suspected of cutting secret deals with hackers to personally profit from ransom money, according to the president, Marc Jason Grens, in a message.
Following this, DigitalMint said it fired the employee immediately. “As soon as we were able, we began communicating the facts to affected stakeholders,” Grens said in an email to Bloomberg . The company noted that it is not under any investigation itself but is fully cooperating with law enforcement.
The person under investigation has not been publicly named. Grens said the matter is still active and does not want to give more details. CEO Jonathan Solomon said the company acted swiftly to protect its clients.
DigitalMint operates in a growing field of companies that step in when businesses are hit by ransomware. These firms help talk with hackers, send cryptocurrency payments, and try to resolve the situation quickly. The industry has grown as ransomware attacks have skyrocketed around the world, costing victims billions of dollars every year.
In ransomware cases, attackers often freeze computer systems, lock up files, or threaten to leak private information unless they’re paid off, usually in cryptocurrency. Some ransom demands can reach tens of millions of dollars. DigitalMint says it has experience in more than 2,000 ransomware incidents since 2017, and that it offers 24/7 access to virtual currency for fast payments.
“A negotiator is not incentivized to drive the price down or to inform the victim of all the facts if the company they work for is profiting off the size of the demand paid,” said James Taliento, CEO of cyber intelligence firm AFTRDRK.
DigitalMint is licensed to transmit money in several U.S. states and is registered with the U.S. Treasury Department’s Financial Crimes Enforcement Network. The company serves a wide range of clients, from small businesses to Fortune 500 companies. Its website promotes “secure handling of ransomware incidents” and “threat actor communications and negotiations.”
Some insurance and legal firms are now warning clients to be cautious about working with DigitalMint while the investigation is ongoing, according to two people familiar with the situation. They spoke anonymously because the matter is sensitive and private.
DigitalMint was founded in 2014 under the name Red Leaf Chicago, LLC. It initially offered services for buying cryptocurrency through ATMs and teller windows.
