Hacker who sold data of 65K medical employees on dark web gets 7 years

Ransomware attacks, explained

Ransomware is an ever-evolving form of malware that scrambles a victim organization’s data with encryption, then criminals demand a ransom in exchange for software decryption keys.

PITTSBURGH - A Michigan man was sentenced to seven years in prison for hacking a human resources database at the University of Pittsburgh Medical Center employee, stealing the personal information of more than 65,000 employees and then selling the information online.

Justin Johnson, 30, on Friday received the maximum sentence by Chief U.S. District Judge Mark Hornak. He previously pleaded guilty to two of the 43 counts against him — one count of conspiracy and one count of aggravated identity theft.

Hornak noted the severity of Johnson’s crimes during sentencing, likening his behavior to a "bulldozer" through people’s personal lives.

Johnson, known on the dark web as "The Dearth Star" and later "Dearthy Star," hacked into the UPMC human resource server databases in 2013 and 2014 and stole personally identifiable information and W-2 information belonging to tens of thousands of employees, prosecutors said.

FILE IMAGE - A sign points to areas on the University of Pittsburgh Medical Center campus in Pittsburgh, Pennsylvania, in a file image taken on Feb. 9, 2008. (Photo by Kevin Lorenzi/Bloomberg via Getty Images)

Johnson then sold the stolen information on dark web forums for use by conspirators, who promptly filed hundreds of false U.S. individual income tax returns in 2014 using UPMC employee personal information.

These false filings under the IRS’ 140 form claimed hundreds of thousands of dollars of false tax refunds, which they converted into Amazon gift cards. Prosecutors said the gift cards were then used to purchase merchandise on the site, which was later shipped to Venezuela.

"Justin Johnson stole the names, Social Security numbers, addresses and salary information of tens of thousands of UPMC employees, then sold that personal information on the dark web so that other criminals could further exploit his victims," said Acting U.S. Attorney Kaufman in a statement. "Today’s sentence sends a deterrent message that hacking has serious consequences."

In addition to the UPMC employee data, Johnson stole and sold nearly 90,000 additional sets of personally identifiable information belonging to non-UPMC workers on the dark web, prosecutors said.

The scheme resulted in approximately $1.7 million in false tax return refunds.

The investigation included agents from the IRS-Criminal Investigation, the U.S. Secret Service and the U.S. Postal Inspection Service, as well as Homeland Security Investigations.

Johnson was arrested last year in Detroit.

"The actions of criminals like Justin Johnson can have long-lasting and devastating effects on the lives of innocent people," said Yury Kruty, the IRS-Criminal Investigation’s acting special agent in charge. "Johnson carried out his intricate scheme with no regard for his victims."

This story was reported from Cincinnati.