Charged With Wire Fraud for Selling a Ransomware Fix That Allegedly Did Not Exist: What Florida IT and Cybersecurity Business Owners Need to Know

When a technology company charges a client to fix a crisis, the way it describes the fix becomes evidence. On October 7, 2026, the Justice Department announced that the owner of a Florida ransomware remediation company was arraigned in the Eastern District of New York on two counts of wire fraud and one count of wire fraud conspiracy. The government does not allege that the company simply failed to get clients their files back. It alleges the company lied about how it did the work, and that the lie is the crime. These are allegations, and the owner is presumed innocent. But the theory is a template, and any Florida IT, managed services, or incident response business that describes its methods in marketing copy, proposals, or emails should read it closely.

The government does not allege the company failed to get clients their files back. It alleges the company lied about how it did the work.

Key Takeaways

• The owner faces two counts of wire fraud and one conspiracy count under 18 U.S.C. §§ 1343 and 1349, each carrying up to 20 years in prison.
• Prosecutors allege the company claimed proprietary decryption tools while secretly paying the attackers for keys, then billed clients far more than it paid.
• A false statement about how a service is performed can support a federal wire fraud charge even when the client receives what it paid for.
• Federal sentencing under USSG § 2B1.1 turns on loss or gain, so invoices, ransom payment records, and client communications drive the exposure calculation.
• Florida technology business owners who learn of an inquiry should retain a federal criminal defense attorney before any agent interview, document request, or grand jury subpoena response.

What the Government Says Happened

According to the Justice Department's release, the company marketed itself as a "principled alternative to paying off ransomware attackers." It allegedly told clients it had proprietary tools and advanced decryption techniques. The government says it had no special decryption technology.

"A principled alternative to paying off ransomware attackers."— The company's marketing, as quoted in the Justice Department's October 7, 2026 release

The allegation is that the company instead contacted the cybercriminals, paid them for decryption keys, and had its employees try the keys on client files. It then billed the client a multiple of what it paid. The release gives one example from August 2023: roughly $8,200 paid in ransom and roughly $150,000 charged to the client. Across the alleged scheme, the government says clients were charged more than $19 million and more than $8 million went out in ransom payments.

The FBI investigated. The Computer Crime and Intellectual Property Section and the U.S. Attorney's Office for the Eastern District of New York are prosecuting. The defendant is a Florida business owner charged in New York, a reminder that venue follows the wires and the clients, not the office address.

What a Wire Fraud Case Like This Is Built From

Prosecutors do not need a technical expert to prove a company overstated its capabilities. They need documents. Marketing pages, sales decks, proposals, statements of work, intake emails, and invoices show what clients were told. Bank records and cryptocurrency transfers show what the company did with client money. Employee communications show who knew what and when.

The employees who handled the work are the pressure point. In a case like this one, staff who applied the keys, wrote the invoices, or answered client questions become witnesses. Some become cooperators. A business owner who assumes loyalty will hold under a grand jury subpoena is making a bet the government is happy to see him make.

The charged theory also reaches the markup. A company is free to charge a high rate for its services. What it cannot do, in the government's view, is justify a fee by describing a method it did not use. That is the line prosecutors draw between aggressive pricing and a scheme to defraud, and it is where these cases are fought.

Prosecutors do not need a technical expert to prove a company overstated its capabilities. They need documents: marketing pages, proposals, invoices, bank records, and employee communications.

Exposure and Charges Under Federal Law

Wire fraud under 18 U.S.C. § 1343 requires a scheme to defraud, intent to defraud, and use of interstate wires to carry it out. Email, online payments, and electronic transfers satisfy the wire element in almost every modern business case. Conspiracy under 18 U.S.C. § 1349 carries the same maximum as the underlying offense, so a conspiracy count adds exposure without requiring any additional conduct.

Two Supreme Court decisions frame the defense. In Ciminelli v. United States, the Court rejected the "right to control" theory and confirmed that wire fraud protects property. In Kousisis v. United States, the Court held that a defendant who induces a transaction through materially false pretenses can be convicted even without proof that the other side suffered economic loss. For a technology company, Kousisis matters most. "The client got its data back" is not a defense if the government can prove the client was induced to hire the company by a material lie about the method.

Sentencing is driven by the Sentencing Guidelines fraud provision, USSG § 2B1.1. Loss sets the base offense level, and where loss is hard to measure the court can look to the defendant's gain. In a case where a client received working decryption keys, the loss number is contestable. That fight, along with enhancements for the number of clients and the use of sophisticated means, usually determines whether a guideline range is survivable. A federal sentencing attorney and a federal wire fraud attorney should be involved before any plea discussion, not after it.

In a case where a client received working decryption keys, the loss number is contestable. That fight usually determines whether a guideline range is survivable.

Conspiracy to commit wire fraud is how the government reaches everyone around the owner. The government also treats these cases as multi-defendant. Anyone who sold, billed, or executed the work can be charged as a co-conspirator, which is why a multi-defendant federal case calls for separate counsel for the owner and for employees.

Critical Mistakes People Make Early

The first mistake is talking to agents. If FBI agents appear at your office or your home, you are not obligated to answer questions, and you are not obligated to explain your methods on the spot. A statement made without counsel can be used to fix the government's version of what your marketing meant. Call a lawyer before you call the agents back.

The second is editing. Owners who learn of an inquiry often scrub a website, soften proposal language, or delete old emails. That conduct can be charged separately under 18 U.S.C. § 1519, and it converts a defensible intent case into an obstruction case. Preserve everything and let counsel decide what happens to public-facing copy.

The third is producing documents voluntarily to show good faith. A production made without a review for privilege, scope, and context hands the government a curated record of your own statements. The fourth is assuming that satisfied clients mean no case. Prosecutors build these cases from payment records and former employees, and they do not need a complaining client to start.

A Defense Approach That Starts Before Charges

The most valuable work happens while the matter is still an investigation. A wire fraud defense attorney conducts a privileged internal review that compares every representation the company made about its methods against what it did on each engagement. Where the two match, the case is weak. Where they diverge, the question becomes intent and materiality, and the defense decides how to frame it.

From there, the decisions are strategic. Whether to engage the prosecutor early, whether to make a pre-charge submission on intent, whether any employee needs separate counsel, and whether a proffer or a "queen for a day" agreement is wise all depend on the documents. A proffer made before the documents are understood is one of the costliest errors in a white collar case.

If charges come anyway, the same review feeds the loss and gain arguments, the Rule 16 discovery demand, and the sentencing position. Work done before indictment is not wasted when the case proceeds. It is the foundation of it.

Why Timing Matters

Charging decisions are fluid early in an investigation. Before an indictment returns, a prosecutor is still deciding who is a target, who is a witness, and how large the case is. Once the grand jury votes, those decisions harden, and the leverage a business owner had to shape them is gone.

For Florida technology companies, the practical point is simple. If you have received a grand jury subpoena, a federal target letter or similar letter from a U.S. Attorney's Office, or a call from an FBI agent about a client engagement, the window to influence the outcome is open now and it does not stay open.

Common Questions

Under Federal Investigation in Florida?

If you own or manage a technology business and a federal agent, grand jury subpoena, or letter from a U.S. Attorney's Office has reached you, the time to speak with counsel is before you respond. AMC Defense Law provides white collar defense attorney and federal investigation defense services, including ransomware defense and wire fraud matters, for business owners and professionals in the Southern and Middle Districts of Florida and nationwide. Consultations are confidential. Contact the firm to discuss your situation.

A privileged internal review compares every representation the company made about its methods against what it did on each engagement.

If you or your loved ones have been arrested or are under federal investigation, call Aaron M. Cohen for a confidential consultation, 24 hours a day to get help.

This article is for general informational purposes only and is not legal advice. Reading it does not create an attorney-client relationship. The matter discussed involves allegations only, and the person charged is presumed innocent. Laws and enforcement priorities change, and outcomes depend on the facts of each case. Prior results do not guarantee a similar outcome. Consult a qualified attorney about your specific situation.

About the author: Aaron M. Cohen is the founder and principal attorney of AMC Defense Law, a criminal defense firm in Boca Raton, Florida, with more than 30 years of experience in state and federal courts. He is admitted to practice in Florida, New York, New Jersey, and the District of Columbia, and before the United States District Courts for the Southern and Middle Districts of Florida, the Southern, Eastern, and Western Districts of New York, the District of New Jersey, and the Northern District of Texas. He appears pro hac vice in other federal districts nationwide. The firm represents clients in federal investigations and prosecutions involving healthcare fraud, Anti-Kickback Statute matters, DME and telemedicine fraud, peptide and compounded-drug enforcement, controlled-substance and drug conspiracy cases, financial crimes, and complex federal litigation, in Florida and nationwide.