PITTSBURGH, PA – Justin Sean Johnson, 30, formerly of Detroit, Michigan, is headed to federal prison for eight years after a judge slammed him with the maximum sentence for a sprawling data breach and tax fraud scheme targeting UPMC employees. Johnson, operating under the aliases TheDearthStar and Dearthy Star on the dark web, systematically infiltrated the University of Pittsburgh Medical Center’s human resources databases in 2013 and 2014.
The scope of the hack was massive. Johnson pilfered Personally Identifiable Information (PII) – names, Social Security numbers, addresses, and salary details – belonging to over 65,000 UPMC employees. But he didn’t stop there. He then hawked this stolen data on dark web forums, providing a treasure trove for other criminals eager to exploit the victims. The result? Hundreds of fraudulent 1040 tax returns filed in 2014, racking up approximately $1.7 million in false refunds.
According to Acting United States Attorney Stephen R. Kaufman, the conspirators weren’t interested in cash. They converted the fraudulent refunds into Amazon.com gift cards, using them to purchase merchandise which was then shipped…to Venezuela. Johnson’s criminal enterprise didn’t end with UPMC. From 2014 through 2017, he continued to steal and sell nearly 90,000 additional sets of PII, opening the door for widespread identity theft and bank fraud.
On Friday, Chief United States District Judge Mark R. Hornak handed down the sentence: 60 months for Conspiracy to Defraud the U.S., and an additional 24 months for Aggravated Identity Theft, totaling 84 months – seven years – behind bars. Judge Hornak didn’t mince words, describing Johnson’s actions as akin to a “bulldozer” indiscriminately trampling through the personal lives of thousands of UPMC employees.
“Justin Johnson stole the names, Social Security numbers, addresses and salary information of tens of thousands of UPMC employees, then sold that personal information on the dark web so that other criminals could further exploit his victims,” Kaufman stated. The U.S. Secret Service, leading the investigation alongside the IRS-Criminal Investigation and the U.S. Postal Inspection Service, emphasized the seriousness of the crime. “There is no hiding place we cannot find,” said Timothy Burke, Special Agent in Charge of the Secret Service Pittsburgh Field Office.
Assistant United States Attorney Gregory C. Melucci prosecuted the case. The investigation underscores the growing threat of cybercrime and the lengths to which criminals will go to profit from stolen personal data. Lesley Allison, Postal Inspector in Charge of the Pittsburgh Division, added that protecting consumers victimized by identity theft remains a core mission for federal law enforcement.
Related Federal Cases
- 23andMe, Data Auction Without Consent, New York NY, 2023 · Kentucky
- 23andMe, Selling Genetic Data Without Consent, New York, 2023 · Kentucky
- Bertram Johnson Jr., Conspiracy and Theft, Michigan 2024 · Maryland
- Kenneth Johnson, Medicare Fraud Scheme, VA 2024 · South Carolina
- Kevin Johnson, Crack Cocaine Conspiracy, Pennsylvania 2024 · Michigan
Key Facts
- Agency: U.S. Secret Service
- Category: Fraud & Financial Crimes
- Source: Official Press Release
Get the grimiest stories delivered weekly. Subscribe free
Browse More
MORE FEDERAL CRIME NEWS
US NewsUS NewsUS NewsUS News