October 20, 2021

Justin Sean Johnson was sentenced to seven years in prison for hacking the University of Pittsburgh Medical Center (UPMC) health care provider and insurer in 2014, stealing the personal information and W-2 information, including names, social security numbers, addresses and salary information of more than 65,000 employees, and then selling it on the dark web.

While Johnson, also known as TheDearthStar and Dearthy Star, was indicted in 2020 on 43 counts of conspiracy, wire fraud and aggravated identity theft, he pleaded guilty to stealing and selling the PII and W2 information of tens of thousands of UPMC employees before he was convicted.

While Johnson infiltrated UPMC’s network in early December 2013 after hacking its Oracle PeopleSoft human resources management system, he infiltrated the company’s servers daily between January 21 and February 14, 2014, to steal the PII of tens of thousands of UPMC employees.

The stolen UPMC employees PII, which Johnson sold to attackers on the dark web in 2014, were used to file hundreds of false tax returns and claims for about $1.7 million, which were later converted into Amazon gift cards.

For more information, read the original story in BleepingComputer.