A sentence years after the attacks
An Armenian national involved in a Ryuk ransomware conspiracy has received a 24-month federal prison sentence, the Justice Department announced September 22. Karen Vardanyan, 35, was also ordered to serve three years of supervised release and pay $1,219,106 in restitution. The case concerned attacks against companies and schools from March 2019 to approximately June 2020, including a victim in Wilsonville, Oregon.
The legal timeline differs from the recovery timeline
Vardanyan was extradited from Ukraine and first appeared in U.S. court in June 2025. He pleaded guilty in July 2026 to conspiracy and computer-fraud charges, according to prosecutors. This is a development in an older criminal case, not an announcement of a new Ryuk campaign. A restitution order also should not be mistaken for confirmation that victims have received payment.
Keep the record after restoring the service
For a school district or small business, the case raises an operational question: would the organization still be able to reconstruct an incident several years later? Our recommendation is to retain a coherent incident file under an approved retention policy. It should connect technical findings with the sequence of decisions, restoration work and documented costs. That is different from indiscriminately keeping every raw log forever, which can create unnecessary cost and privacy exposure.
Separate the owners of unfinished work
Recovery teams should identify who retains vendor reports, who tracks financial records and who responds to later investigative requests. An MSP handover should specify which evidence the customer receives and which records remain with the provider. Criminal proceedings may continue well beyond the end of an emergency engagement; business recovery should not depend on a future prosecution or restitution payment. The durable lesson is to finish the operational work while preserving an intelligible account of what happened and what it cost.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
