Business

FTC shuts ‘sextortion help’ firm accused of taking $60m from victims

FTC wins order halting Digital Forensics Corporation over alleged $60m sextortion help scheme. What it means for UK buyers of forensics services.

Scales of justice graphic with the headline FTC halts $60m sextortion help firm

The US Federal Trade Commission has persuaded a federal judge to halt Digital Forensics Corporation, a firm it accuses of taking at least $60m from sextortion victims for investigations it never carried out. The case is a reminder that anyone selling “cyber help” to people in a panic needs vetting, and the firm’s own website says it serves customers in the UK.

What happened

On 13 October 2026 the FTC announced that a federal court in the Northern District of Ohio had granted a temporary restraining order against Digital Forensics Corporation (DFC), its owner Dmitry Belkin and a dozen linked companies. According to Techlicious, the complaint had been filed under seal roughly a week earlier. The regulator wants a permanent injunction, money for consumers and an asset freeze.

Everything below is an allegation made by the FTC. None of it has been tested in court, and neither DFC nor Belkin’s attorney replied to requests for comment from The Record and CyberScoop.

The regulator’s central claim is that between February 2023 and July 2026 the group collected at least $60m from people being blackmailed with intimate images, selling them services that were mostly not delivered. CyberScoop reports that the complaint traces deceptive telemarketing by the wider group back to at least 2020. Linked brands include 1st All Data Recovery and sites such as BlackmailHelpline.com, promoted through paid ads on Google, YouTube and X.

The alleged breaches span the FTC Act, telemarketing rules, rules on fake reviews and the Gramm-Leach-Bliley Act. Christopher Mufarrige, who runs the agency’s Bureau of Consumer Protection, said the firm “preys on consumers already in crisis”.

How it works

As the complaint describes it, the model had two stages. A “Phase 1” package, priced between $1,499 and $20,000, promised to stop the attack, trace the blackmailer through a “tracking campaign”, produce an investigative report, send a cease-and-desist letter and pass evidence to the police.

The FTC says the reality was far thinner. Staff allegedly changed settings on the victim’s own social media accounts to block the extortionist, something any victim can do in a minute, and then manufactured evidence of work. Chat transcripts were reportedly invented, and former employees quoted in the complaint say “tracking” reports reused location coordinates saved in advance, often pointing to Nigeria or the Philippines. Law enforcement was not contacted, and victims were allegedly told the police would not help them.

“Phase 2” was ongoing monitoring of the victim’s accounts and the wider web, usually sold for a further $2,000 to $5,000 or more. Techlicious reports that a former employee estimated more than half of customers bought it; The Record’s reading of the complaint is that every customer was pushed towards it.

The sales process is the most troubling part. CyberScoop reports that Belkin wrote a call script built around fear, and that staff completed a form after each call confirming they had used phrases such as “life altering”. Pitches were reportedly tailored to the victim: military personnel were warned of a dishonourable discharge, and married customers were told their spouse and in-laws would be targeted.

The reputation side was manufactured as well. The FTC alleges that staff in India wrote fake positive reviews, that Uber drivers were paid to post fabricated testimonials with staged photos, and that unhappy customers were sent to a counterfeit Better Business Bureau site so their complaints never reached the real one. According to The Record, a USA Today investigation in March 2025 made similar claims and reported instalment plans charging up to 18% interest.

Flow diagram of the sales model the FTC alleges Digital Forensics Corporation used, from search adverts to fake reviews

Why it matters for UK organisations

This looks like a US consumer case, but two things make it relevant here. First, DFC’s own website lists the United Kingdom among the countries it serves and carries guidance aimed at UK blackmail victims.

Second, the alleged playbook works on businesses too. Organisations buy forensic, incident response and “recovery” services under the same conditions these victims did: something has gone badly wrong, the board wants it fixed today, and the first provider that answers the phone with confidence often gets the job. The site recently covered the MonsterCloud charges in the ransomware recovery market. Unvetted crisis-response suppliers are a procurement risk, not a one-off.

There is also a staff welfare angle. A blackmailed employee searching online for help may well click the first advert they see. Well-run organisations tell staff where legitimate help is before they need it.

Expert view

What stands out to me is how closely the alleged method copies the look of genuine digital forensics while leaving out the substance. Real investigative work produces evidence that can be checked: hashes, preserved logs, timestamps and a chain of custody that a solicitor or police officer can rely on. A pin on a map proves nothing, but a frightened person or a stressed executive is in no state to notice.

In my experience, the warning signs in crisis-response sales are much the same whether the customer is a teenager or a FTSE 250 company. The seller promises certainty about attribution, which honest responders rarely offer. They push hard on urgency and fear. They discourage you from going to the police or your insurer. They will not say who will actually do the work or what qualifications that person has.

Attribution claims deserve particular scepticism. Tracing a financially motivated extortionist to a named person and location is hard, slow and usually needs lawful access to data held by platforms. Any provider claiming to do it quickly and privately, for a fixed fee, should be challenged on how.

What to do now

  1. Pre-approve your responders. Agree incident response and forensics suppliers before an incident, ideally from an assured scheme or your insurer’s approved panel, so nobody is choosing from search adverts under pressure.
  2. Ask for evidence standards in writing. Before engaging anyone, ask how they preserve evidence, who will do the work, what qualifications they hold and what a sample deliverable looks like. Vague answers are a red flag.
  3. Never let a supplier discourage reporting. Reporting to the police, your insurer and, where personal data is involved, the ICO is your decision. A provider that argues against it should be dropped.
  4. Tell staff where real help is. Include sextortion in awareness training. For adults in the UK, the Revenge Porn Helpline is a free service supporting victims of intimate image abuse, and it operates StopNCII.org, which helps stop intimate images being shared on participating platforms.
  5. Harden the accounts that get targeted. Multi-factor authentication, privacy settings that limit who can message staff, and prompt blocking and reporting of extortion attempts all reduce exposure. This fits the Cyber Essentials user access control requirements and good secure configuration.
  6. Check reviews properly. Review scores are weak evidence; look for regulator action and independent references you can speak to.

Bottom line

If the FTC’s allegations are proven, DFC took money from people at their lowest point and gave them invented evidence in return. Whether it is an individual being blackmailed or an organisation dealing with ransomware, the time to choose who you will call is before the crisis, not during it.

Sources

Related Posts