PITTSBURGH, Pa. (WTAJ) – A man was arrested Tuesday morning in Detroit, Michigan for allegedly hacking the University of Pittsburgh Medical Center (UPMC) human resource databases.

According to a release by the Department of Justice, Justin Sean Johnson, 29, was indicted by a federal grand jury in Pittsburgh on charges of conspiracy, wire fraud and aggravated identity theft associated with the 2014 hack.

According to the Indictment, Johnson used a name identified by an acronym as “TDS” or “DS” infiltrated and “hacked” into the human resource server databases at UPMC in January 2014, and stole employees’ Personally Identifiable Information (PII) and W-2 information.

The information was sold by Johnson on the dark web from 2014 through 2017. This resulted in the filing of tens thousands of false IRS tax returns, approximately $1.7 million in refunds.

The refunds were converted into Amazon.com gift cards, which were then used to purchase Amazon merchandise which was shipped to Venezuela.

Justin Johnson stands accused of stealing the names, Social Security numbers, addresses and salary information of every employee of Pennsylvania’s largest health care system. After his hack, Johnson then sold UPMC employees’ PII to buyers around the world on dark web marketplaces, who in turn engaged in massive campaign of further scams and theft.

His theft left over 65,000 victims vulnerable to years of potential financial fraud. Hackers like Johnson should know that our office will pursue you relentlessly until you are in custody and held accountable for your crimes.

United States Attorney Scott W. Brady

Johnson made an initial appearance Wednesday in Federal Court in the Eastern District of Michigan. He faces a number of years in prison and thousands of dollars in fines for each count if convicted.