Brian Krebs reported that an information technology specialist at FEMA has been charged in a 43-count indictment for hacking into the University of Pittsburgh Medical Center six years ago, and selling 65,000 employee records to tax fraudsters on the dark web and stealing directly from corporate payrolls.
According to the indictment, Johnson stole employee information on all 65,000 then current and former employees, including their names, dates of birth, Social Security numbers, and salaries. The stolen data also included federal form W-2 data that contained income tax and withholding information, records that prosecutors say Johnson sold on dark web marketplaces to identity thieves engaged in tax refund fraud and other financial crimes. The fraudulent tax refund claims made in the names of UPMC identity theft victims caused the IRS to issue $1.7 million in phony refunds in 2014. Prosecutors allege Johnson’s intrusion into UPMC was not an isolated occurrence, and that for several years after the UPMC hack he sold personally identifiable information (PII) to buyers on dark web forums.
unknownx500
