Justin Sean Johnson, UPMC HR Database Hacking, Pennsylvania 2020

A Michigan man has pleaded guilty to hacking the human resources databases of the University of Pittsburgh Medical Center, stealing sensitive personal information of tens of thousands of UPMC employees.

Justin Sean Johnson, aka TheDearthStar and Dearthy Star on the dark web, 30, of Detroit, Michigan, pleaded guilty to Counts 1 and 39 of a 43-count Indictment before Chief United States District Judge Mark R. Hornak.

In connection with the guilty plea, the court was advised that Johnson hacked into the UPMC human resource server databases in 2013 and 2014 and stole sensitive personal information and W-2 information belonging to tens of thousands of UPMC employees.

The information was sold by Johnson on dark web forums for use by conspirators, who promptly filed hundreds of false 1040 tax returns in 2014 using UPMC employee personal information.

These false 1040 filings claimed hundreds of thousands of dollars of false tax refunds, which they converted into Amazon.com gift cards, which were then used to purchase Amazon merchandise that was shipped to Venezuela.

Additionally, Johnson stole and sold nearly 90,000 additional sets of personal information to buyers on dark web forums, which could be used to commit identity theft and bank fraud.

The scheme resulted in approximately $1.7 million in false tax return refunds, and the law provides for a maximum sentence of five years in prison and a fine of not more than $250,000 for the conspiracy to defraud the United States.

Pending sentencing, the court ordered Johnson to remain detained. The case was investigated by the Internal Revenue Service-Criminal Investigation, the United States Secret Service, the United States Postal Inspection Service, and Homeland Security Investigations.