Hive Ransomware Operator Sentenced to 70 Months for Hospital and Government Attacks

What happened

Artem Stryzhak, a Ukrainian‑born cybercriminal, acted as an affiliate of the Nefilim ransomware group before joining Hive. Between 2021 and 2023 he helped Hive launch ransomware campaigns that encrypted thousands of systems in hospitals, government agencies and private enterprises across the United States, Canada, Australia and 80 other nations. The attacks disrupted patient intake, forced service outages and generated over $100 million in ransom payments. After a multi‑year FBI investigation, Stryzhak was arrested in Spain in June 2024, extradited to the United States, pleaded guilty in December 2025, and was sentenced to 70 months in federal prison. Hive’s administrator, Volodymyr Tymoshchuk, remains at large with a federal reward for information.

Why it matters for trust and compliance

• The case highlights the critical importance of maintaining documented, auditable incident‑response plans—a control objective that maps to multiple frameworks such as NIST CSF and ISO 27001.
• Demonstrates the need for auditable incident‑response evidence to satisfy audit‑readiness requirements.
• Supports continuous monitoring of response metrics, helping organizations prove control effectiveness across frameworks.

Who is affected

Recommended actions

1. Review and update your incident‑response playbooks, ensuring they include evidence‑collection steps aligned with audit requirements.