How a hostage negotiator outsmarts ransomware hackers

Moty Cristal honed a talent for high-stakes negotiations dealing with Hamas and Hezbollah before expanding to talks with ransomware gangs.

Negotiator Moty Cristal says the key when dealing with ransomware demands is to understand that “behind the keyboard on the other side there’s a human being”. Amit Elkayam

Marissa Newman

Updated May 14, 2025 – 4.07pm, first published at 12.00pm

Email LinkedIn Twitter Facebook

Subscribe to gift this article

Gift 5 articles to anyone you choose each month when you subscribe.

Subscribe now

Already a subscriber?

In 2015, cybercriminals targeted several currency trading companies and stole sensitive data, leaving behind a ransom note. They received a frantic response from a woman named Helena, who identified herself as a European executive from one of the companies tasked with handling the negotiations. In increasingly flustered exchanges over WhatsApp, Helena implored them to lower their price.

Unbeknown to the hackers, the author of the texts wasn’t an executive, wasn’t a woman and wasn’t truly panicking. Behind the screen was actually Moty Cristal, a veteran Israeli hostage negotiator more accustomed to speaking to radicals from Hamas and Hezbollah than criminal gangs. Adopting the Helena persona was Cristal’s first time trying a technique that would become one of his calling cards in a decade-long stint representing global companies in hundreds of high-stakes ransomware negotiations.

Bloomberg Businessweek