The US Department of Justice says it’s arrested Nickolas Sharp for allegedly stealing information from an unidentified technology company, demanding a $2 million ransom in exchange for the compromised data, and pretending to be a whistleblower in communications with reporters.
The DOJ accuses Sharp of “secretly stealing gigabytes of confidential files from a New York-based technology company where he was employed…and then, while purportedly working to remediate the security breach, extorting the company for nearly $2 million for the return of the files and the identification of a remaining purported vulnerability.”
BleepingComputer reports that Sharp was employed by Ubiquiti, a networking equipment provider that disclosed a data breach in January. Brian Krebs of KrebsOnSecurity reported in March that an anonymous whistleblower claimed the Ubiquiti breach was “catastrophic” and that the company was covering up the full extent of the incident to protect its share price.
That reporting had an impact: DOJ says that “Following the publication of these articles, between March 30, 2021, and March 31, 2021, Company-1’s stock price fell approximately 20%, losing over $4 billion in market capitalization.” Ubiquiti’s stock fell from $349 on March 30 to $290 on April 1; the company’s shares are currently selling for roughly $305.
The incident highlights the risks posed by insider threats. Sharp allegedly exploited his access to Ubiquiti’s cloud services to compromise sensitive information, used his status at the company to join the incident response team, and then exacerbated the problem by exaggerating the extent of the breach to the press. This wasn’t a sophisticated hack—it was an abuse of Ubiquiti’s trust.
Sharp allegedly used the Surfshark VPN service to hide his IP address while he was conducting the attack. A problem with that service briefly exposed his true IP address, however, which is part of what led the Justice Department to identify him as the attacker.
“We allege Mr. Sharp created a twisted plot to extort the company he worked for by using its technology and data against it,” FBI Assistant Director Michael Driscoll said in a statement. “Not only did he allegedly break several federal laws, he orchestrated releasing information to media when his ransom demands weren’t met. When confronted, he then lied to FBI agents. Mr. Sharp may have believed he was smart enough to pull off his plan, but a simple technical glitch ended his dreams of striking it rich.”
Sharp faces four counts: transmitting a program to a protected computer that intentionally caused damage, transmission of an interstate threat, wire fraud, and making false statements to the FBI. The maximum sentences for those counts range from two to 20 years in prison.
