FEMA IT Specialist Charged in ID Theft, Tax Refund Fraud Conspiracy
Summary: A FEMA IT specialist, 29-year-old Justin Sean Johnson, was arrested in Michigan on June 16 on a 43-count indictment alleging he hacked UPMC's Oracle PeopleSoft HR databases in 2013 and 2014 and stole names, dates of birth, Social Security numbers, salaries and W-2 data on all 65,000 then current and former employees. Prosecutors say he sold the records on dark web forums under the aliases DearthStar and TheDearthStar, and that fraudulent 1040 returns filed in victims' names led the IRS to issue $1.7 million in phony refunds in 2014.
What you should know: The stolen W-2 data turned directly into $1.7 million in IRS refunds converted to Amazon gift cards and shipped to Venezuela - a reminder that HR records are cash to a determined insider, and that the person with PeopleSoft administration skills on your payroll may be the threat.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026