A Tampa-based medical device manufacturer fell victim to an ALPHV/BlackCat ransomware attack, orchestrated by insiders including a ransomware negotiator (Kevin Tyler Martin) and an incident response manager (Ryan Clifford Goldberg), who allegedly conspired with the ransomware group. The attack encrypted critical servers, halting operations and forcing the company to pay $1.27 million in cryptocurrency to regain access. The breach not only caused severe financial loss but also posed risks to patient safety and supply chain disruptions, given the company’s role in producing medical devices. The incident highlights the dual threat of insider collusion and ransomware-as-a-service (RaaS), where trusted security professionals exploited their positions to facilitate cyber extortion. While no explicit data exfiltration details were disclosed, the attack’s scale—targeting a healthcare-adjacent manufacturer—suggests potential downstream impacts on hospitals and patient care. The case is part of a broader conspiracy involving at least five U.S. companies, with law enforcement later dismantling ALPHV/BlackCat’s infrastructure in late 2023.

In May 2023, the company fell victim to a targeted ALPHV BlackCat ransomware attack orchestrated by affiliates Ryan Clifford Goldberg and Kevin Tyler Martin. The attackers encrypted critical servers, crippling operations and exfiltrating sensitive data before demanding a $10 million ransom. Under duress, the company negotiated a reduced payment of $1.27 million in cryptocurrency to regain access to its systems. The incident caused major operational disruptions, including delays in medical device production and supply chain interruptions, while exposing proprietary and potentially regulated data. The financial strain extended beyond the ransom, encompassing forensic investigations, system restoration, and reputational damage. As a healthcare-adjacent entity, the breach raised concerns about patient safety risks tied to device functionality and data integrity. The attack was part of a broader ALPHV campaign targeting U.S. infrastructure, with federal prosecutors later linking it to a structured ransomware-as-a-service (RaaS) operation involving dark web negotiations and cryptocurrency laundering.