Nickolas Sharp, a former employee at Ubiquiti, a US-based communication and IoT device maker, has been sentenced to prison for six years for posing as a hacker and attempting to extort the company for nearly $2 million. Sharp had access to Ubiquiti‘s confidential information and abused his access to download gigabytes of it while interviewing for another company. In January 2021, he sent a ransom note to the company claiming to be a hacker with breached systems and demanding the ransom to prevent data leak. The FBI traced Sharp’s hacking activities and discovered his attempts to extort his employer and informed him the consequence of his actions.
Ubiquiti refused to pay the sum, and as a result, Sharp made some of the company’s stolen files public. He then lied to agents when they executed a search warrant at his residence in Portland, Oregon, and later contacted investigative journalist Brian Krebs, claiming to be a whistleblower working with Ubiquiti, and provided false information, which led to the publication of several news articles. Sharp’s false claims resulted in Ubiquiti‘s shares falling by roughly 20%, resulting in losses of over $4 billion.
Damian Williams, the US Attorney for the Southern District of New York, revealed that Sharp was paid close to a quarter million dollars a year to ensure the company’s cybersecurity but instead misused his access. Sharp’s cybercrime involved stealing a massive amount of sensitive data, extorting his employer for ransom money, obstructing law enforcement, spreading false news stories that harmed the company and investors, and attempting to implicate innocent employees in the attack.
In conclusion, this case reinforces the importance of cybersecurity and highlights how critical employee cybersecurity awareness is, especially in protecting a company’s confidential information. It also underscores the consequences of cybercrimes committed by employees with privileged access, leading to significant financial and reputational damage to a company. Companies should continuously invest in cybersecurity training and tools to prevent such incidents from occurring. Employees should also take their cybersecurity responsibilities seriously and report any suspicious activities they observe.
<< photo by Tima Miroshnichenko >>
You might want to read !
- A Call for Age Verification: A Clash Between Privacy and Industry Standards
- Data Privacy Concerns Prompt Companies to Improve Deletion Practices
- The Non-Stop Malicious Traffic: Inside Black Hat’s NOC
- “Millions of WordPress Websites at risk: Plugin vulnerability exploited by attackers”
- “Cloud Security at Risk: New Study Reveals Over 1/3 of Companies Reuse Passwords”
