DOJ indictment of three Russians highlights preventive gaps as CISA faces deep cuts

The DOJ’s indictment of three Russian nationals for a cybercrime scheme that bilked American victims—hospitals, schools, and banks in 21 states—out of $61 to $62 million is a classic after-the-fact enforcement action. Charges are filed, but the victims absorb the losses. Multiple local news outlets (WKBN/WJW and LocalNews8/CNN) report the loss at $61-$62 million, aligning more closely with the indictment itself than the $63 million figure cited in some outlets. The action underscores a fundamental imbalance: the administration prioritizes prosecution over prevention, leaving critical infrastructure and consumers exposed.

While the DOJ touts the indictment, the Trump administration’s FY2026 budget proposal cuts funding for the Cybersecurity and Infrastructure Security Agency (CISA) by approximately $495 million, according to verified reports from Cybersecurity Dive, Infosecurity Magazine, and Defense One. This is nowhere near “over $1 billion” as sometimes claimed, but it is still a significant reduction that limits CISA’s ability to help vulnerable entities—like the hospitals and schools hit in this scheme—patch systems and block attacks before they occur. The most recent Congressional action proposed a roughly $135 million cut, and a January 2026 DHS spending agreement set the reduction at about $300 million. In any case, the trajectory is clear: the federal government is gutting the very agency tasked with preventive cybersecurity.

The indictment is a hollow victory when the underlying vulnerabilities remain unaddressed. The administration’s broader program integrity push focuses on cutting benefits rather than shoring up defenses. If the goal is to protect Americans from cyber threats, the DOJ must pair enforcement with robust funding for CISA, not starve the agency that could have stopped the attacks before they happened.