Two email accounts of a ransomware distributor were recently compromised. The analysis of these accounts gives an interesting “behind the curtain” view of a ransomware distributor.