Hacker who locked up hospitals and firms gets nearly 6 years in prison

A US court has sentenced Artem Stryzhak, a 35-year-old Ukrainian, to 70 months in prison, a little under six years. He took part in ransomware attacks on hospitals, government bodies and large businesses around the world between 2018 and 2021. Ransomware is software that locks up a victim's files until a payment is made.

What he did

Stryzhak was an affiliate of two ransomware groups, Nefilim and Hive. An affiliate rents the criminal software and shares the profits with its creators. Court documents say he paid 20% of all ransom payments he collected for access to Nefilim and its decryption keys, which unlock stolen files. That began in June 2021, and he stayed active until October 2021.

With Nefilim, he went after big companies in the United States, Canada and Australia, each earning more than $100 million a year. One of the group's administrators later urged him to aim at firms making more than $200 million. With Hive, he hit seven victims, including a dentist's office, several law firms and a healthcare provider during the COVID-19 pandemic.

The pressure tactics

Victims were squeezed twice. Their files were locked, and the criminals also threatened to publish stolen data on dark web sites called "Corporate Leaks" unless the ransom was paid. The dark web is a hidden part of the internet that ordinary search engines do not show.

How he was caught

Spanish authorities arrested Stryzhak in June 2024. He was sent to the United States on April 30, 2025. In December 2025, he pleaded guilty to computer fraud conspiracy. The charges covered attacks on businesses in the United States, Norway, France, Switzerland, Germany and the Netherlands.

The FBI says the groups he worked with disrupted patient care and caused more than $100 million in losses. A US attorney said the Nefilim group attacked approximately 1,500 victims worldwide.

What is still open

One alleged accomplice is still free. Volodymyr Tymoshchuk is accused of being an administrator for the LockerGoga, MegaCortex and Nefilim gangs. The US State Department offers up to $11 million for information leading to his arrest. He is on the FBI and European Union most-wanted lists.

What to do

A prison sentence does not end the threat, since many groups are still active. Owners of clinics, offices and small firms can use this case as a prompt for two checks:

• Confirm your backups exist, are recent, and can actually be restored.
• Make sure staff logins are strong, because attackers who get valid passwords are much harder to stop.