by Andrew Murray | September 25th, 2019
On August 28, 2019, the Department of Justice announced that a former Seattle tech worker has been indicted on wire fraud and computer theft charges. The Press Release states:
* * *
A former Seattle technology company software engineer was indicted today by a federal grand jury on two counts related to her unauthorized intrusion into stored data of more than 30 different companies, announced U.S. Attorney Brian T. Moran. PAIGE A. THOMPSON a/k/a erratic, 33, will be arraigned on the indictment in U.S. District Court in Seattle on September 5, 2019. THOMPSON remains in custody.
THOMPSON is charged with wire fraud and computer fraud and abuse for the intrusion into data of Capital One and more than 30 other entities. Law enforcement has identified many of the victims whose data was accessed and is working to notify them. The indictment describes some of the victims as a state agency outside the State of Washington; a telecommunications conglomerate outside the United States; and a public research university outside the State of Washington.
According to the indictment, THOMPSON created scanning software that allowed her to identify customers of a cloud computing company who had misconfigured their firewalls, allowing outside commands to penetrate and access their servers. THOMPSON used this access not only to steal data, but also used stolen computer power to “mine” cryptocurrency for her own benefit, a practice known as “cryptojacking.”
Law enforcement became aware of THOMPSON’s activity after she shared information with another user on the site GitHub relating to her theft of information from the servers storing Capital One data. On July 17, 2019, the GitHub user alerted Capital One to the possibility it had suffered a data theft. After determining on July 19, 2019, that there had been an intrusion into its data, Capital One contacted the FBI. Cyber investigators confirmed THOMPSON was the person responsible for the data theft. On July 29, 2019, agents executed a search warrant at THOMPSON’s residence and seized electronic storage devices containing a copy of the data. Investigators have found no evidence that THOMPSON sold or disseminated any of the information she accessed.
The charges in the indictment carry penalties of up to 25 years in prison.
* * *
The indictment is available on the Department’s website.
DISCLAIMER: The Vernia Law Firm has joined in filing a class action lawsuit against Capital One concerning this breach.
