NetWalker Ransomware: A Gatineau Man Gets 20 Years
Modern ransomware does not only lock files. It steals them first. This case, built across the border, ended with a long sentence and a large forfeiture.
By Siddharth ShankarUpdated October 11, 2026A US Justice Department release says a Gatineau, Quebec man was sentenced on October 4, 2022 to 20 years in prison and ordered to forfeit $21,500,000 for his role in NetWalker ransomware attacks. Victims included companies, municipalities, hospitals and universities. Canadian officers arrested him on January 27, 2021 and seized cash and 719 bitcoin. See how stolen data spreads.
Your email is the key to most of your accounts. Has it already leaked?
Free · About 30 seconds · No sign-up · Email not stored
Ransomware is often described as a problem for the organizations that get hit. But organizations hold the records of ordinary people, and the data-theft side of ransomware means those records can leak. The NetWalker case shows both sides: the damage a group can cause and the unusual outcome of an arrest and sentence.
What happened
According to the US Department of Justice, a Canadian man from Gatineau, Quebec was sentenced to 20 years in prison on October 4, 2022 and ordered to forfeit $21,500,000, with restitution to be set later. The US Attorney said he had exploited "hundreds of victims in numerous countries."
Canadian officers arrested him on January 27, 2021. They seized C$742,840 and 719 bitcoin, which the release values at about $21,849,087 at the time of seizure and $14,463,993 at sentencing. He was extradited to the United States.
How it worked
The release describes NetWalker attacks as encrypting and stealing victims' data. Victims included companies, municipalities, hospitals, law enforcement, emergency services, school districts, colleges and universities. This is the "double extortion" model: the attacker locks systems and also threatens to publish what was taken.
The case involved several agencies, including the RCMP, the Ontario Provincial Police, Gatineau police and the National Cybercrime Coordination Unit, with the FBI's Tampa office leading on the US side.
What was exposed
The release says data was stolen from victim organizations but does not list what kinds of records or how they were used. We do not guess. What we can say from the types of victims is that hospitals, schools and municipal bodies typically hold personal records about patients, students and residents.
For a person whose records sat inside one of those organizations, the practical risk is the same as in any breach: details could circulate even after the criminal is caught. That is an inference from the types of victim, not a finding in the release.
How it ended
For the criminal justice outcome, this is one of the stronger endings in this series. The sentence was 20 years, the forfeiture $21.5 million and a large cryptocurrency seizure took place in Canada. The restitution amount was left for a later hearing, so what individual victims eventually receive is not stated.
Prosecution does not reverse a leak. Data that was already published or sold stays in circulation.
Quick check before you read on: is your email in a known data breach? Free, about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
Key facts at a glance
- Sentence: 20 years in prison
- Date: October 4, 2022
- Forfeiture: $21,500,000, with restitution to be set later
- Arrest in Canada: January 27, 2021
- Seized: C$742,840 and 719 bitcoin
- Victim types: companies, municipalities, hospitals, emergency services, schools and universities
What it means for you
1Assume records held by institutions can leak
You cannot stop it, so reduce the damage by using unique passwords and multi-factor authentication.
2Read breach notices carefully
Confirm they are real using our guide on real versus phishing breach notices.
3Freeze credit when identity details are involved
4Watch for follow-up scams
Criminals reuse leaked records to make fake calls sound real.
What the release does not say
The release does not name the specific victims, the amount of ransom paid in total or what happened to data after the attacks. For a ransomware case that ended in a regulatory fine instead of a prison term, see the Advanced care software case.
Why this case matters
Cases like this show that ransomware crews are not untouchable. Investigators followed the group across borders, traced cryptocurrency and made arrests in a country different from the one where many victims were located. The seizure of 719 bitcoin also shows that digital money can be frozen when it moves through identifiable channels.
At the same time, the case is a reminder of how much sensitive data public bodies hold. Hospitals, schools and municipalities were among the victims, and ordinary people have little say in how those records are protected.
If this case made you want to check your own position, start with these guides on how data breaches happen, how to tell a real breach notice from a phishing message and what each type of breached data means. You can also try our free email exposure check.
Sources
- US Department of Justice: Canadian national sentenced for NetWalker ransomware attacks (20 years, $21.5 million forfeiture, arrest, seizure values)
Frequently asked questions
What is NetWalker?
According to the US Justice Department, NetWalker was ransomware used in attacks that encrypted and stole victims' data, hitting organizations such as companies, hospitals and universities.
What sentence did the Gatineau man receive?
He was sentenced to 20 years in prison on October 4, 2022 and ordered to forfeit $21,500,000, with restitution to be set later.
What is double extortion?
It is when attackers both encrypt a victim's systems and steal data, then threaten to publish it unless a payment is made.
Does a conviction remove leaked data from circulation?
No. Arrests and sentences punish the offender, but stolen data that was already shared or sold can remain available.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Compare data removal services
See which services work in your country, what they cost, and the free do-it-yourself route.
Compare removal services →Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.