Hacker who sold UPMC employee data on the dark web sentenced to prison

A Michigan man was sentenced Monday to seven years in prison for hacking into UPMC databases and stealing data of more than 65,000 employees and selling it on the dark web in 2014.

U.S. District Chief Judge Mark Hornak imposed the maximum sentences against Justin Sean Johnson, 30, for the crimes of conspiracy to defraud the country and aggravated identity theft.

Johnson pled guilty to just two of the 43 counts the charges in May.

Acting U.S. Attorney Stephen R. Kaufman said Johnson, known on the dark web as “TheDeathStar” and “Dearthy Star,” infiltrated and hacked into the UPMC human resources server databases in 2013 and 2014 and stole sensitive information including W-2s.

He then sold that information on forums for use by conspirators, who then filed hundreds of false 1040 tax returns using employee data.

Investigators with the IRS, U.S. Postal Service and U.S. Secret Service conducted a nearly five-year investigation concerning Johnson and his co-conspirators.

The investigation also showed Johnson stole and sold nearly 90,000 additional non-UPMC sets of personal information to buyers on dark web forums, which could be used to commit identity theft and bank fraud.

At least one co-conspirator, Yoandy Perez Llanes, was arrested in Venezuela. He pleaded guilty in Pittsburgh in 2017.

Kaufman said the scheme resulted in about $1.7 million in false tax return refunds.

“Today’s sentence sends a deterrent message that hacking has serious consequences,” Kaufman said.

Acting Special Agent in Charge of IRS-Criminal Investigation Yury Kruty echoed those sentiments, and stressed the damage such hacking and data selling can do.

“The actions of criminals like Justin Johnson can have long-lasting and devastating effects on the lives of innocent people,” Kruty said.

They found that Johnson, who had become an expert in the software used by UPMC, used that expertise to hack their employee database.

He is being held in the Butler County Prison and appeared for Thursday’s hearing on an online video program.