Latvian Ransomware Negotiator Sentenced to 102 Months for $56 Million Attacks

CINCINNATI – A Latvian national was sentenced to 102 months in federal prison on May 4, 2026, for serving as a negotiator in the Karakurt ransomware group, which conducted cyberattacks leading to $56 million in extortions, per a U.S. Department of Justice press release.

The attacks affected victims worldwide, with the group—also known as TommyLeaks and SchoolBoys Ransomware—targeting organizations and extracting payments totaling $56 million, according to the Justice Department document. This scope includes multiple sectors hit by data theft and encryption, forcing payments to restore access.

Prior to the sentencing, the defendant operated freely as part of the global ransomware operation. Now, he begins an 8.5-year term effective immediately, following his conviction in the Southern District of Ohio, as detailed in the press release.

The imprisonment removes a facilitator from the Karakurt network, triggering potential disruptions in ongoing operations and prompting federal investigators to pursue related assets under forfeiture statutes cited in the case. It also activates standard post-sentencing procedures, including possible appeals within 14 days and coordination with international law enforcement for extraditions of co-conspirators.

Agencies like the FBI, already involved per the release, will likely intensify tracking of the group's remaining members.

This marks the latest U.S. action against Karakurt, following indictments of other affiliates in 2024 and 2025 that dismantled parts of the network's infrastructure. The group emerged in 2021, per public Justice Department records, evolving from earlier ransomware variants.