There's a long-standing joke in cybersecurity circles that some ransom negotiators have suspiciously good relationships with the criminals they're supposedly negotiating against. It turns out federal investigators don't find it funny — because in at least one case, they think it was literally true.

US federal investigators have identified executives at two separate ransomware negotiation firms who they believe maintained "unusually close" ties to ShinyHunters, the hacking group behind some of the most damaging data breaches of the last two years. More damning still: one of those executives — based in the United States — is suspected of helping ShinyHunters operate the extortion website used to pressure victims into paying up.

Let that sink in. The person you hired to lower your ransom bill may have been on the payroll of the people sending it.

What's the context here?

ShinyHunters is no small-time crew. The group has claimed responsibility for breaches affecting tens of millions of records across healthcare, telecoms, and financial services. They recently stole highly sensitive data from the FBI itself — a breach that accelerated the federal investigation now bearing down on the group.

And in a separate but related story published the same day, Florida authorities confirmed that ShinyHunters was behind a breach of the Florida DMV that exposed records on current and former residents stretching back to 2006. The access vector? A police department had stored its SFTP login credentials insecurely, and attackers simply walked in with them.

Why the negotiator angle matters so much

Ransomware negotiation is a legitimate and often essential industry. When a hospital or a council gets locked out of its systems at 2am, you call a negotiator. They have relationships, they understand the groups, they know what's a real threat and what's posturing.

That same intimacy is exactly what makes the alleged conflict of interest so corrosive. If a negotiator is feeding victim information to the threat actor — or helping maintain the pressure site that makes victims feel like they have no choice but to pay — the entire premise of the service collapses.

Krebs on Security reports that investigators are pursuing both executives, though no charges have been filed publicly yet. The firms involved haven't been named.

What to watch

The ransomware negotiation industry has no formal licensing or oversight framework in most jurisdictions. Anyone can hang out a shingle. This case will almost certainly accelerate calls for regulation — expect to hear from the US Cybersecurity and Infrastructure Security Agency and, in Australia, the ACSC, which has already flagged third-party incident response providers as an emerging risk category in its threat landscape reporting.

Australian organisations should also note that any engagement with external incident response or negotiation firms involves sharing sensitive operational and data-related information. The ACSC's guidance on ransomware response recommends vetting third-party providers carefully — and this case is a vivid illustration of why that guidance exists.

The broader lesson is familiar but worth repeating: the people you trust in a crisis have enormous power over the outcome. Verifying who you're trusting before the crisis hits isn't paranoia. It's the job.