Hacker steals data on 780,000 Utahns from state computer

USA TODAY

By Michael Winter

April 9, 2012

A computer hacker stole Social Security numbers for 280,000 Utahns and swiped names, addresses and birth dates for 500,000 others, state officials said today.

Utah Department of Technology Services

Officials announced the dramatically higher estimates at a news conference, the Salt Lake Tribune reports. Utahns covered by Medicaid or the Children’s Health Insurance Program (CHIP) who sought health care in the past four months are the most likely victims of the identify theft, officials said.

They first believed that the data theft, which occurred late April 1, involved only 24,000 Medicaid payment claims or eligibility inquiries. That estimate grew to more than 182,000 and included people covered by CHIP, among others.

A hacker traced to Eastern Europe first accessed a weakly protected computer server at the Utah Department of Health on March 30. The thief downloaded about 224,000 files, some of which contained hundreds of records, said health department spokesman Tom Huduchko, the Associated Press says. The breach was discovered April 2.

In a statement, the Department of Technology Services explained that a “configuration error occurred at the password authentication level, allowing the hacker to circumvent DTS’s security system.”

The stolen Social Security numbers did not include other personal information, he said. But the files had other data for 500,000 additional individuals.

The DTS noted in an FAQ (pdf) that claims payment and eligibility inquiries “contain sensitive, personal health information from individuals and health care providers. Such information could include Social Security numbers, names, dates of birth, addresses, diagnosis codes, national provider identification numbers, provider taxpayer identification numbers, and billing codes.”

The revised figure means that roughly one in four Utahns may have had their individual information compromised.

State officials will be contacting affected residents. Those whose Social Security numbers were stolen will receive a year of free credit-record monitoring. The news release has more information.

Direct Link: http://content.usatoday.com/communities/ondeadline/post/2012/04/hacker-steals-data-on-780k-from-utah-state-computer/1?csp=34news#.T4ZNqNmWtI5

Computer expert who stole eight million people’s personal details for an ‘intellectual challenge’ jailed for two and half years

Program scanned through 200,000 PayPal accounts
Part of Nokia internal network temporarily shut down
Girlfriend used stolen card details to try and pay for luxury hotels
Hacker hoarded enough personal details to fill 67,500 double-sided A4 pages

MAIL Online (UK)

By Phil Vinter

3 April 2012

A computer hacker illegally acquired enough credit and debit card details to carry out a potential £800,000 worth of fraud.

Edward Pearson, 23, of Lendale, York, used a trojan virus to download thousands of credit card details along with the postcodes, passwords, names and dates of birth of more than eight million people in the UK.

One of his programs scanned through 200,000 accounts registered to online payment service PayPal – identifying names, passwords and current balances.

Pearson, an ‘incredibly talented’ boarding school student who carried out the crime for an ‘intellectual challenge’, has been jailed for two years and two months.

Fraudster: Edward Pearson, 23, stole the personal details of more than eight million people.

Pearson’s girlfriend Cassandra Mennim, 21, tried to pay for luxury hotels using stolen credit card details

He also managed to shut down part of the mobile phone giant Nokia’s internal network for two weeks after hacking in and copying the details of over 8,000 members of staff, Southwark Crown Court heard.

His 21-year-old girlfriend, Cassandra Mennim, a sociology student at the University of York, triggered a police inquiry after she tried to pay for luxury hotel stays using stolen credit card details.

Pearson was arrested after investigators linked a web alias, ‘G-Zero’, which had appeared on hacking forums, to his personal email address.

On one of his computers officers found 8,110,474 names, dates of birth, and postcodes for adults living in the UK.

Police officers in the case said that if the details were printed onto double-sided A4 it would fill a staggering 67,500 sheets.

David Hughes, prosecuting, said the hacker had carried out a series of ‘sophisticated, planned frauds.’

He said: ‘Pearson used his considerable expertise for his criminal intentions.

‘When police examined other computers they found the details of 2,701 credit or debit cards.

‘Based on the average fraud used on a single card being £309, the potential gain to be made by him was £834,000.

‘In fact the actual fraud on these credit and debit cards attributed to Pearson amounted to £2,351, but the total on the cards was £39,832.’

The details were all stolen over an 18-month period between January 1, 2010, and August 30, 2011.

Pearson coded trojan viruses, called Zeus, SpyEye and Python, to automatically scour the internet in search of personal details.

His Python program successfully downloaded the details of 200,000 PayPal accounts.

Mr Hughes added that Pearson had hacked into the systems of Nokia and web giant AOL to gain access to their employees’ details, as well as other sensitive information.

‘This had a significant negative impact on the company, which had to shut its networks down for two weeks while checks were carried out on it,’ he said.

Mennim was caught after booking rooms at the Cedar Court Grand Hotel and Lady Anne Middleton Hotel, both in York, using stolen credit card details and PayPal accounts.

Andrew Bodnar, defending Pearson, said his hacking had not been for financial gain, but more as an intellectual challenge.

‘This is a young man who has very advance computer skills, but has put them to the wrong use, but he is not the criminal mastermind that everyone claims he is.

‘The total amount of money he fraudulently amounted, is the figure of £2,351.

Pearson’s girlfriend Cassandra Mennim tried to pay for a luxury hotel stay at the Cedar Court Grand Hotel in York

Mennim also used PayPal details to tell staff she would pay for an expensive stay at Lady Anne Middleton’s Hotel, in York

‘These have been done using the Paypal accounts, to order pizza and other takeaway foods, and to pay for mobile phone accounts.

‘It is fair to say that he produced the Trojan, Zeus and other software as an intellectual challenge, and he hacked into Nokia to see if he could.’

He added that although he had shared some of the details, he had never sold them.

Shut down: Mobile phone giant Nokia was shut down by Pearson for two weeks after he hacked in to their network and copied the details of more than 8,000 members of staff, Southwark Crown Court heard

Stephen Grattage, defending Mennim, who gained 9 A’s and 4 A*’s at GCSEs, said she was a vulnerable young women who had found comfort in Pearson following a difficult previous relationship.

‘She stands before the court, saying she is ashamed of herself, and she is ashamed of her actions and is very sorry.

‘She says she will pay back the money that she owes to the hotel.’

‘This was a very sophisticated crime, in which you managed to access highly confidential information and put many individuals at risk of attack.’
MS RECORDER ANN MULLIGAN

Sentencing Pearson to two years and two months and handing Mennim a 12 month supervision order the judge Ms Recorder Ann Mulligan said: ‘It is extremely regrettable that you two promising young individuals find yourself in the dock.

‘This was a very sophisticated crime, in which you managed to access highly confidential information and put many many individuals at risk of attack.

‘You had a staggering amount of personal details, 8.1 million, which included names, dates of births, credit and debit card details and security codes, the use of which they could have been used for, is hard to imagine.

‘Your computers and software were a devastating tool kit.

‘I accept that you didn’t sell this information, but you shared it with other computer programmers, and you had no way of knowing how they might use this information.

Victim: Online payment provider PayPal was hacked into by computer expert Edward Pearson

‘This stupendous criminality was not about financial gain, but about an intellectual challenge.’

Pearson, originally from Blandford Forum, Dorset, and now of Lendale, York, admitted making an article for use in fraud and two counts of possession of an article for use in fraud.

Mennim, of Balmoral Terrace, South Gosforth, Newcastle upon Tyne, admitted two counts of obtaining services dishonestly.

More…

Direct Link: http://www.dailymail.co.uk/news/article-2124114/Computer-hacker-Edward-Pearson-Lendale-York-stole-million-people-s-personal-details-jailed-half-years.html