Ex-Worker Pleads Guilty in Pharma Attack

Thursday, August 18, 2011 @ 04:08 PM gHale

Yes, hackers do attack from outside a company. But manufacturers also have to be aware of former employees getting even.

That happened when a former employee of a pharmaceutical manufacturer was able to wipe out most of the company’s computer infrastructure earlier this year and it ended up costing $800,000.

Utilities Beware: More Attacks Coming
Insider Threat to Utilities
Smart Grid Security a Top Priority
Secure Smart Grid Moves Forward

Jason Cornish, 37, formerly an IT staffer at the U.S. subsidiary of Japanese drug-maker Shionogi, pleaded guilty this week to computer intrusion charges in connection with an attack on Feb. 3, 2011.

He wiped out 15 VMware host systems that were running email, order tracking, financial and other services for the Florham Park, NJ, company. The pharmaceutical maker also had offices in Georgia.

“The Feb. 3 attack effectively froze Shionogi’s operations for a number of days, leaving company employees unable to ship product, to cut checks, or even to communicate via email,” the U.S. Department of Justice said in court filings. Total cost to Shionogi was $800,000.

Cornish resigned from the company in July 2010 after getting into a dispute with management, but he stayed on as a consultant for two more months.

In September 2010, the drug-maker laid off Cornish and other employees, including his friend and former supervisor, court documents said. The supervisor refused to hand over network passwords to company officials and lost his job because of this, court documents said.

Using a Shionogi account, Cornish was able to log into the company’s network from a public Internet connection, at a local McDonald’s, in February and connect to a vSphere VMware management console that he’d secretly installed on the company’s network a few weeks earlier.

Using vSphere, he deleted 88 company servers from the VMware host systems, one by one.

The FBI’s investigation revealed the attack originated from a computer connected to the wireless network of a Smyrna, GA, McDonald’s where Cornish had used his credit card to make a purchase minutes before the attack.

“The computers on which companies do business are the engines of the 21st century economy,” said U.S. Attorney Paul J. Fishman after charging Cornish in July. “Malicious intrusions are against the law, regardless of motive. Hacking attacks devised as personal revenge can have serious repercussions for perpetrators as well as victims.”

He faces a maximum of 10 years in prison and a $250,000 fine at his Nov. 10 sentencing.

Leave a Reply

You must be logged in to post a comment.