A Canadian national indicted in 2020 in a $27 million ransomware fraud case affecting the senior living industry recently was extradited to the United States to face those charges.
Sebastien Vachon-Desjardins was indicted on conspiracy to commit computer fraud and wire fraud, intentional damage to a protected computer, and transmitting a demand in relation to damaging a protected computer. The charges arose from his alleged participation in a hacker ring known as NetWalker, which extorted at least $27.6 million from dozens of businesses, healthcare providers, law enforcement and educational institutions all over the world.
Lorien Health Services, which provides assisted living, skilled nursing and rehabilitation services at nine locations in Maryland, was one of NetWalker’s alleged victims, as previously reported by McKnight’s Senior Living. The data breach in 2020 reportedly exposed the personal information of almost 48,000 residents. It included names, Social Security numbers, dates of birth, addresses, and health diagnoses and treatment information.
Lorien reported the matter to the FBI, notified potentially affected residents, and hired cybersecurity experts to aid in its response to the incident.
The Justice Department said the ransomware attacks specifically targeted the healthcare sector during the COVID-19 pandemic, “taking advantage of the global crisis to extort victims.”
Vachon-Desjardins, of Quebec, was arrested by Canadian law enforcement officers on Jan. 27, 2021. Canadian officials executed a search warrant on his home, where officers discovered and seized 719 Bitcoin — valued at more than $28 million.
Vachon-Desjardins made his initial appearance in federal court last Thursday in Tampa, FL. According to court documents, he conspired to — and did intentionally — damage a protected computer and transmit a ransom demand from April to December 2020.
In a Justice Department news release, U.S. Attorney Roger B. Handberg for the Middle District of Florida said that ransomware is a “multi-billion dollar criminal enterprise that transcends physical and political boundaries.”
Last month, an Ontario court judge sentenced Vachon-Desjardins to seven years in prison after he pleaded guilty to five counts tied to 17 ransomware attacks between May 2020 and January 2021 in Canada amounting to $2.8 million.
The charges included mischief and theft of computer data, extortion, payment of cryptocurrency ransoms and participating in the activities of a criminal organizations. Vachon-Desjardins also agreed to partial restitution, forfeiture of assets seized and a DNA order. He is serving his Canadian sentence while his U.S. case winds through the courts.
