The hacker responsible for getting access to the University of Pittsburgh Medical Center (UPMC) databases and stole the W-2 details and personally identifiable information (PII) of roughly 65,000 UPMC workers has been given the maximum sentence for the offenses and will be in jail for 7 years.
Sean Johnson, a resident of Detroit, Michigan, also known as TheDearthStar and Dearthy Star – hacked into the UPMC databases in 2013 and 2014 and took highly sensitive data. Then he sold the stolen data on dark web hacking forums. Identity thieves used the information to file fake tax returns in the names of UPMC workers. The Department of Justice (DOJ) also alleged Johnson carried out other cyberattacks from 2014 to 2017 and stole the PII of a further 90,000 people. Those sets of information were additionally sold to identity thieves on dark web discussion forums.
A total of $2.2 million fraudulent tax returns were filed and about $1.7 million was given by the IRS. The money obtained was converted to Amazon gift cards and was employed to buy high-value products that were delivered to Venezuela.
Three co-conspirators of Johnson were caught and charged for what they did in the UPMC cyberattack. In August 2016, Cuban national Yolandy Perex Llanes was extradited to the U.S.. In April 2017, he pleaded guilty to committing cash laundering and aggravated identity theft. He was also sentenced to 6 months in prison in 2017.
In April 2017, Justin A. Tollefson of Spanaway, Washington pleaded guilty to doing four counts of using the stolen identities of UPMC staff members to file bogus tax returns. He had bought the PII on a dark web community forum and utilized the data to submit fake tax returns in the names of four UPMC staff. $56,333 was paid by the IRS in income tax repayments, however, Tollefson was caught before he got any funds. The judge was lax as Tollefson had not profited from the fraudulence and sentenced him to 3 years of probation in 2017.
Maritza Maxima Soler Nodarse, a national of Venezuelan, pleaded guilty to committing conspiracy to con the United States in July 2017 for her work in the identity theft and tax fraud criminal offenses. She was given a 16-month sentence in prison and was deported to Venezuela.
Johnson got the maximum sentence in spite of pleading guilty to the hacking acts because of the seriousness of the offenses and the effect they had on the lives of his victims. Chief United States District Judge Mark R, Hornak stated Johnson’s conduct was devastating to people and his hacking activities showed no respect for them. “The actions of bad guys such as Justin Johnson can have lasting and harmful results on innocent people.
Johnson was penalized to serve 60 months in jail for the conspiracy to defraud the United States charge and an obligatory 24-month sentence for aggravated identity theft, with the sentences to run consecutively.
The information stolen by Justin Johnson includes the names, Social Security numbers, addresses, and salary data of tens of thousands of UPMC workers. He sold that personal data on the dark web so that other crooks could also exploit his victims. Today’s sentence sends a discouraging message that hacking has severe effects.