A Brazilian national has been indicted in the United States for allegedly threatening to release data stolen during a hack of a company’s network in March 2020.
Junior Barros De Oliveira, a 29-year-old from Curitiba, Brazil, faces four counts of making extortionate threats related to data obtained from protected computers and four counts of issuing threatening communications, according to an indictment unsealed by the U.S. Department of Justice (DoJ) earlier this week.
The case involves a Brazilian subsidiary of a New Jersey-based company, whose systems were breached on multiple occasions by De Oliveira. The hacker reportedly accessed confidential customer data from approximately 300,000 individuals.
In September 2020, De Oliveira allegedly contacted the company’s chief executive officer (CEO) under an alias, demanding 300 bitcoin—equivalent to roughly $3.2 million at the time—to refrain from selling the stolen information.
A month later, the defendant allegedly sent a similar email to both the CEO and an executive at the Brazilian subsidiary.
In a follow-up message to a company representative, De Oliveira offered to assist in resolving the security vulnerability but demanded a “consulting fee” of 75 bitcoin, which was worth about $800,000 at the time. The email also included instructions for transferring the payment to a Bitcoin wallet.
Each of the four extortion charges carries a maximum penalty of five years in prison and a fine of up to $250,000 or double the financial impact of the crime. The charges for threatening communications each carry a maximum sentence of two years and the same fine.