Blue Lance InfoSec Blog

Ex-General Motors employee charged in $40M theft of trade secrets

The FBI has released details of a federal indictment of a couple charged with conspiracy to possess trade secrets without authorization, unauthorized possession of trade secrets, and wire fraud.  Shannon Du and Yu Chin are charged with stealing thousands of GM documents regarding to the company's hybrid technology worth an estimated 40 million dollars. 

According to the press release,

According to the indictment, from December 2003 and continuing through May 2006, the defendants conspired to possess trade secret information of General Motors Company relating to hybrid vehicles, knowing that the information had been stolen, converted, or obtained without authorization. The indictment alleges that Du, while employed with GM, provided GM trade secret information relating to hybrid vehicles to her husband, Qin, for his benefit and for the benefit of a company, Millennium Technology International Inc. (MTI), that the defendants owned and operated. Approximately five days after Du was offered a severance agreement by GM in January 2005, she copied thousands of GM documents, including trade secret documents, to an external computer hard drive used for MTI business. A few months later, Qin moved forward on a new business venture to provide hybrid vehicle technology to Chery Automobile, a Chinese automotive manufacturer based in China and a competitor of GM. The indictment further alleges that in May 2006, the defendants possessed GM trade secret information without authorization on several computer and electronic devices located in their residence.

Full press release

Former GEXA Employee Sentenced to 1 Year for Damaging Computer Network

Steven Jinwoo Kim, a former database administrator for GEXA Energy in Houston, Texas,  was sentenced last week to 12 months in prison for hacking into his former employer's computer network and causing damage after he was terminated in 2008.  In addition, Kim was ordered to pay $100,000 in restitution to GEXA. 

According to a Justice Department press release:

According to court documents, on Feb. 5, 2008, GEXA Energy terminated Kim from his position as a senior database administrator and revoked all his administrative rights and access to the GEXA Energy computer network. In pleading guilty, Kim admitted that in the early hours of April 30, 2008, he used his home computer to connect to the GEXA Energy computer network and a database that contained information on approximately 150,000 GEXA Energy customers. While connected to the computer network, Kim recklessly caused damage to the computer network and the customer database by inputting various Oracle database commands. Kim also copied and saved to his home computer a database file containing personal information on the GEXA Energy customers, including names, billing addresses, social security numbers, dates of birth and drivers license numbers. According to court documents, Kim’s actions caused a $100,000 loss to GEXA Energy.

Read the press release

Sheriff's Deputy Convicted of Exceeding Authorized Computer Access

A former Harris County Sheriff deputy has been convicted of using his access to the National Crime Information Center (NCIC) to sell confidential data to an individual working as a confidential informant for the FBI.

From the Houston Office of the FBI:

The charges against Green are the result of an FBI undercover operation initiated after receiving information that Kurt Green, an employee of the HCSO assigned to the jail, sold information from the federal database known as NCIC. The NCIC database is maintained by the FBI. On Jan. 12, 2010, in a recorded telephone conversation, the informant provided deputy Green with the names of 10 persons—none of whom were under investigation—and requested criminal histories for the informant’s personal use. A week later, on Jan. 19, Green and the informant met in a parking lot in Houston. In an audio/video recording Green provided NCIC printouts for seven of the 10 persons to the informant, explained the printouts were from the NCIC database, and was paid $4900 by the informant for the information.

Green faces a maximum punishment of five years in prison, up to three years of supervised release, and a maximum fine of $250,000.

Read the press release

Former J.P. Morgan Chase Employee Admits Stealing Customer Information

Christine Fahmy, a former bank teller at J.P. Morgan Chase from Sciota, Pennsylvania pleaded guilty in U.S. District Court for her role in the theft of over $60,000 from customer's.  

According to press release issued by the FBI's Pennsylvania office:

Pfannenschmidt stated that Christine Fahmy, age 22, of Sciota, Pennsylvania, admitted to committing the offense in 2008 and early 2009. Fahmy admitted that when she was a teller at J.P. Morgan Chase and Company in Hackettstown, New Jersey, she accessed 12 customer account profiles and sold them to two individuals in Monroe County. As part of the scheme, Fahmy’s two confederates, Lavan Blair and Jonnell Gantt, used the customer profile information to have false identification documents made and used to access the accounts to obtain the money.

Blair and Gantt have already pleaded guilty to charges that include bank fraud and attempted bank fraud as aiders and abettors.  

For her role, Fahmy faces up to 10 years in prison and a $250,000 fine.

Read the full press release

Former Societe Generale employee charged with stealing trading source code

On Monday, the New York Field Division of the FBI announced the arrest of Samarth Agrawal, charged with theft of trade secrets for allegedly stealing proprietary computer code used in the high-frequency trading system of Societe Generale, his former employer.

Agrawal began working at Societe Generale in March 2007 as a quantitative analyst.  Shortly after being promoted to a trader position in April 2009, he obtained access to the code. 

In April 2009, AGRAWAL was promoted to the position of trader within the Company's High-Frequency Trading Group. On Friday, June 12, 2009, AGRAWAL obtained access to a unit of the Code ("Unit A") relating to the type of trading activity in which he was involved. However, AGRAWAL also was able to obtain access to a unit of the Code ("Unit B") with which he was not otherwise involved, and did not have permission to review.

After copying portions of the code into Microsoft Word documents, Agrawal printed hundreds of pages over a period from August to September 2009.  On at least one occasion, surveillance cameras captured Agrawal placing the documents into a backpack.

Likewise, on August 31, 2009, September 2, 2009, and September 11, 2009, AGRAWAL similarly printed out multiple portions of Unit B Code, also from Microsoft Word documents, which did not relate to the trading activity in which he was involved.

On November 12, 2009, his last day in the office, AGRAWAL deleted a folder on his personal network drive that contained the Code in its original format as well as the Code that had been gathered together in Microsoft Word documents. Starting on the next day, AGRAWAL took four sick days and was absent from the Company's New York offices. Subsequently, on November 17, 2009, AGRAWAL submitted a letter of resignation to his supervisor at the Company.

After AGRAWAL submitted his resignation, one of his supervisors spoke to him in an effort to convince him to stay at the Company. Among other things, the supervisor reminded AGRAWAL of his promotion to trader and told him that if he stayed his 2010 bonus would be "many multiples" of his 2009 bonus, which had been $130,000. AGRAWAL, in declining the offer, told the supervisor, among other things, that he eventually wished to return to his native country of India to set up his own high-frequency trading firm. AGRAWAL was later contacted by an FBI agent, who was acting in an undercover capacity, and advised the agent that he had been interviewing with "most of the big names" among New York financial firms.

Read the Press Release

Albany hospital worker arrested for stealing patient information

Johnathan Harwood, an employee at St. Peter's Hospital in Albany, New York has been arrested for allegedly stealing personal information from patients and using the data to obtain credit cards.

According to the report from CBS 6, Harwood did make one purchase before getting caught.

Harwood managed to make one purchase, but the item was sent to the residence of one of the identity theft victims, the Sheriff's Office said.

Investigators believe that only three patients data were affected.

More information at CBS 6

Former NSA executive charged for theft and disclosure of classified information

The U.S. Department of Justice announced a 10-count indictment charging Thomas Drake, a former National Security Agency senior executive with willfully retaining classified information, obstruction of justice and making false statements.

Drake, who was employed at the NSA from 2001 to 2008, allegedly served as the confidential source of newspaper reporter for a series of articles published between February 2006 and November 2007.  During this time, Drake allegedly researched stories for the reporter, providing both classified and unclassified documents from the NSA's classified network, and reviewed and helped edit drafts of the reporter's articles.

According to the press release:

The indictment also alleges that Drake took a series of steps to facilitate the provision of this information to the reporter, including:

• exchanging hundreds of e-mails with and meeting with the reporter;
• researching stories for the reporter to write in the future by e-mailing unwitting NSA employees and accessing classified and unclassified documents on classified NSA networks;
• copying and pasting classified and unclassified information from NSA documents into untitled word processing documents which, when printed, had the classification markings removed;
• printing both classified and unclassified documents, bringing them to his home, and retaining them there without authority;
• scanning and emailing electronic copies of classified and unclassified documents to the reporter from his home computer; and
• reviewing, commenting on, and editing drafts of the reporter’s articles.

Drake is charged with five counts of willfully retaining documents that relate to the national defense, obstruction of justice, and four counts of making false statements to the FBI.  He faces a maximum penalty of 90 years in prison and $2.5 million in fines.

Read the full press release

Florida couple indicted for theft of patient data

The FBI and the U.S. Attorney for the Southern District of Florida announced the indictment of Ruben Rodriguez and Maria Victoria Suarez, a Coral Gables couple, for the theft of personal data from patients to be sold to personal injury lawyers and clinics.  The information would then be used to solicit those patients for lawsuits.

According to the indictment, defendant Rodriguez solicited the assistance of a co-conspirator, who at the time was employed by AMR, an ambulance service provider that offered emergency and non-emergency medical transport services in Miami-Dade County. Defendant Rodriguez reached an agreement with the co-conspirator that required the co-conspirator to illegally gain access to certain personal information of individuals transported by AMR and to turn over that information to Rodriguez, in exchange for payments from Rodriguez.

The indictment further alleges that defendant Rodriguez would, in turn, sell the personal identification information he received from the co-conspirator to either of the following: (1) personal injury attorneys, who would use the personal identification information to improperly solicit individuals transported by AMR with hopes of representing them in future legal proceedings; and/or (2) personal injury clinics, who would use the personal identification information to improperly solicit individuals transported by AMR to offer medical services. The payments defendant Rodriguez received from the attorneys and clinics were determined, in part, by any resulting lawsuits, settlements, payments, and/or reimbursements.

The indictment additionally alleges that in the midst of this conspiracy, defendant Rodriguez introduced the co-conspirator to defendant Suarez, his wife, who thereafter, along with defendant Rodriguez, purchased the illegally obtained information from the co-conspirator for subsequent resale to others, as described above.

According to CBS4 in South Florida, this is not the first time the pair has bagged for this type of activity:

The couple was charged with conspiracy to steal patient records from Jackson Memorial Hospital last year. Rodriguez and Suarez allegedly used the same technique to get the information and get rich off of it. 

According to investigators Rodriguez paid JMH ultrasound technician Rebecca Garcia $1000 a month for patient records between December 2006 and February 2009. 

An unnamed personal-injury lawyer reportedly wrote checks worth more than $85,000 to a shell company between 2006 and 2009. The false account allegedly provided Rodriguez and Suarez kickback money.

That case has not yet gone to trial.  Let's hope the courts have the good sense to hold them without bail this time.

HSBC employee data theft said to affect 15,000 account holders

HSBC says in a statement that information stolen by a former IT employee affects 15,000 existing Swiss client accounts.   According to the statement:

It is now clear that the theft, which was perpetrated by a former IT employee about three years ago, involves approximately 15,000 existing clients who had accounts with the bank in Switzerland before October 2006. The stolen client information is limited to accounts in Switzerland, excluding ex-HSBC Guyerzeller accounts. There is no data compromised for any branches of the bank outside Switzerland, which operate on separate systems and security, or other entities within the HSBC Group,

Alexandre Zeller, CEO of HSBC Private Bank SA said "We deeply regret this situation and unreservedly apologise to our clients for this threat to their privacy. We are determined to protect our clients’ interests and are taking every necessary measure to do so, actively contacting all our clients with Swiss-based accounts."

The bank said that it has spent more than $93 million in system upgrades and security improvements.

The bank is cooperating with the Swiss authorities and continues its own investigations, and a criminal investigation led by the Swiss Federal Prosecutor is underway. The Swiss authorities confirmed to us that they will not support the use of the stolen data to answer requests from foreign authorities. The French authorities have informed the Swiss authorities that the data they hold will not be used inappropriately.

West Memphis Police Officer Terminated, Under Investigation for Accessing Employee Personal Info

WMC-TV in West Memphis reports that an FBI investigation is underway of a West Memphis police officer suspected of accessing the personal information of other officers.  The suspect, an unnamed detective in the police department, has been terminated.

From the report:

According to Paudert, files containing the names and social security numbers of police department employees were stored on the computer network, making the employees vulnerable to identity theft.

"It's very disturbing to us that someone, first of all, would do that, and secondly, what it would do to the employees that work here," Paudert said.

To date, it is unclear how the detective was able to access the files via a hack or a lapse in network security, and whether or not any other files were affected.  West Memphis Police Department employees have been notified and asked to monitor their credit reports for irregularities.