A Pittsburgh federal grand jury has indicted a man living in Venezuela on charges of filing fraudulent tax returns using stolen identities from hundreds of UPMC employees.
U.S. Attorney for the District of Western Pennsylvania, David Hickton, said Friday he believes the indictment will frustrate the hacking conspiracy group. Yoandy Perez Llanes, 31, has been charged with 21 counts of money laundering, conspiracy and aggravated identity theft.
“There are three other unidentified co-conspirators that have been specified in the indictment and our efforts to bring closure to this and bring people to justice here in Pittsburgh would be harmed if I gave any more specifics right now,” Hickton said.
Hickton said he would not comment if a there was a warrant for Llanes arrest. The United States does, though, have an extradition treaty with Venezuela.
In early 2014, Llanes and the co-conspirators hacked into a UPMC database stealing names, Social Security numbers, dates of birth and other identifying information, according to the indictment. That information was used to file more than 900 federal tax returns from 2013 in which Llanes requested refunds in the form of Amazon.com gift cards.
“Then they used the monetization of the Amazon account to purchase high-end electronic devices like computers and cell phones, and they had those ship to Miami where they were then re-shipped offshore,” Hickton said.
Around $2.2 million in refunds was requested; prosecutors said $1.4 million was received.
Hickton called the hacking widespread and the criminal scheme complex. According to the indictment, conspirators “used anonymous and encrypted email to disguise their identities and proxy computers to file returns.”
Use of the internet to protect personal information comes with great risk of exposure, Hickton said.
“Any organization that is entrusted with the information on its system should and is generally doing things to do their best to protect it, but it’s a risk reduction process, not an elimination effort,” he said.
Hickton said UPMC and employees should have peace of mind as those who profited have been indicted. He said the computer intrusion investigation will include prevention procedures.
“We’re as focused on the prevention work as we are focusing on the prosecution and enforcement work,” he said.
