Former Employee Of Technology Company Pleads Guilty To Stealing Confidential Data And Extorting Company For Ransom

Damian Williams, the United States Lawyer for the Southern District of New York, announced that NICKOLAS SHARP pled responsible these days in Manhattan federal court docket to various federal crimes in connection with a scheme he perpetrated to secretly steal gigabytes of private information from a community New York-centered engineering enterprise where by he was employed (“Company‑1”). When purportedly doing work to remediate the protection breach for Firm-1, SHARP extorted the business for just about $2 million for the return of the documents and the identification of a remaining purported vulnerability. SHARP subsequently re-victimized his employer by producing the publication of deceptive news articles or blog posts about the company’s handling of the breach that he perpetrated, which were adopted by the decline of around $4 billion in Enterprise-1’s current market capitalization. SHARP pled responsible to intentionally damaging a shielded personal computer, wire fraud, and earning false statements to the Federal Bureau of Investigation (“FBI”) just before U.S. District Decide Katherine Polk Failla.

U.S. Legal professional Damian Williams reported: “Nickolas Sharp’s firm entrusted him with confidential data that he exploited and held for ransom. Adding insult to injury, when Sharp wasn’t specified his ransom needs, he retaliated by resulting in wrong news stories to be released about the corporation, which resulted in his company’s market place capitalization plummeting by around $4 billion. Sharp’s responsible plea currently ensures that he will face the outcomes of his destructive steps.”

As alleged in the Indictment and based on statements and filings designed in courtroom:

At all occasions appropriate to the Indictment, Business-1 was a technological know-how organization headquartered in New York that manufactured and offered wireless communications products and whose shares were being traded on the New York Stock Exchange. NICKOLAS SHARP was utilized by Enterprise-1 from in or about August 2018 by means of on or about April 1, 2021. SHARP was a senior developer who had entry to credentials for Corporation-1’s Amazon Web Expert services (“AWS”) and GitHub Inc. (“GitHub”) servers.

In about December 2020, SHARP frequently misused his administrative obtain to download gigabytes of private data from his employer. For the majority of this cybersecurity incident (the “Incident”), SHARP employed a digital personal community (“VPN”) support that he subscribed to from a enterprise named Surfshark to mask his Online Protocol (“IP”) tackle when he accessed Firm-1’s AWS and GitHub infrastructure devoid of authorization. At 1 stage throughout the exfiltration of Business-1 data, SHARP’s home IP handle became unmasked next a momentary world-wide-web outage at SHARP’s home.

In the course of the course of the Incident, SHARP induced destruction to Corporation-1’s laptop devices by altering log retention procedures and other files in get to conceal his unauthorized exercise on the community. In or about January 2021, although working on a workforce remediating the results of the Incident, SHARP sent a ransom take note to Organization-1, posing as an anonymous attacker who claimed to have received unauthorized obtain to Organization-1’s personal computer networks. The ransom notice sought 50 Bitcoin, a cryptocurrency — which was the equivalent of close to $1.9 million, based on the prevailing exchange price at the time — in exchange for the return of the stolen info and the identification of a purported “backdoor,” or vulnerability, to Enterprise-1’s laptop techniques. Just after Company-1 refused the demand, SHARP posted a part of the stolen data files on a publicly accessible online system.

On or about March 24, 2021, FBI brokers executed a research warrant at SHARP’s residence in Portland, Oregon, and seized specified electronic gadgets belonging to SHARP. During the execution of that lookup, SHARP created quite a few wrong statements to FBI brokers, which include, between other matters, in substance, that he was not the perpetrator of the Incident and that he experienced not employed Surfshark VPN prior to the discovery of the Incident. When confronted with information demonstrating that SHARP obtained the Surfshark VPN support in July 2020, around six months prior to the Incident, SHARP falsely said, in section and compound, that a person else ought to have used his PayPal account to make the purchase.

Various times immediately after the FBI executed the search warrant at SHARP’s home, SHARP brought about wrong information stories to be published about the Incident and Firm-1’s reaction to the Incident and relevant disclosures. In those people stories, SHARP discovered himself as an anonymous whistleblower within Business-1 who had worked on remediating the Incident. In particular, SHARP falsely claimed that Organization-1 experienced been hacked by an unknown perpetrator who maliciously acquired root administrator entry to Enterprise-1’s AWS accounts. In fact, as SHARP very well understood, SHARP experienced taken Company-1’s details applying qualifications to which he had obtain in his position as Company‑1’s AWS cloud administrator, and SHARP experienced used that facts in a unsuccessful attempt to extort Organization-1 for millions of dollars.

Adhering to the publication of these content articles, in between March 30, 2021, and March 31, 2021, Organization-1’s inventory price fell close to 20{18fa003f91e59da06650ea58ab756635467abbb80a253ef708fe12b10efb8add}, dropping over $4 billion in current market capitalization.

* * *

SHARP, 37, of Portland, Oregon, pled guilty currently to a person depend of transmitting a software to a shielded laptop or computer that deliberately prompted destruction, 1 rely of wire fraud, and one particular count of creating untrue statements to the FBI. These offenses carry a overall optimum sentence of 35 yrs in prison.

The most prospective sentences are approved by Congress and are offered here for informational uses only, as any sentencing of the defendant will be decided by the choose. SHARP is scheduled to be sentenced by Choose Failla on May perhaps 10, 2023, at 3:00 p.m.

Mr. Williams praised the superb investigative get the job done of the FBI.

This situation is getting handled by the Office’s Intricate Frauds and Cybercrime Unit. Assistant U.S. Lawyers Vladislav Vainberg and Andrew K. Chan are in charge of the prosecution.