Former Ubiquiti employee gets 6 years in jail for stealing confidential data and extorting company

A former Ubiquiti employee has been sentenced to six years in jail for the theft of confidential data and extorting company for ransom.

NICKOLAS SHARP, a former Ubiquiti employee was sentenced today to six years in prison.

In December 2020, SHARP stole gigabytes of data from the company, then he posed as an anonymous hacker that was offering support to the company to recover the stolen files and identify the alleged flaw exploited in the alleged security incident. 

“In December 2020, SHARP secretly stole gigabytes of Company-1’s data.  While purportedly working to remediate the security breach he created, SHARP extorted the company, as an anonymous hacker, for nearly $2 million for the return of the files and the identification of a remaining purported vulnerability.” reads the press release published by DoJ. “SHARP subsequently re-victimized his employer by causing the publication of misleading news articles as a purported anonymous whistleblower about the company’s handling of the breach that he perpetrated, which were followed by the loss of over $4 billion in Company-1’s market capitalization.”  

In January 2021, SHARP was working on a team remediating the security incident, when he sent a ransom note to the company. He was posing as a threat actor who claimed to have obtained unauthorized access to Ubiquiti’s networks.  The man demanded the payment of a 50 Bitcoin ransom (approximately $1.9 million based on the prevailing exchange rate at the time) for the return of the stolen data and the identification of a purported vulnerability.  The company refused to pay and the man published a portion of the stolen files on a publicly accessible online platform.

SHARP also acted to make its activity as malicious operations conducted by other coworkers. 

SHARP (37) was arrested in December 2021, in March he pleaded guilty to posing as an anonymous hacker and a whistleblower to extort almost $2 million worth of cryptocurrency while working at Ubiquiti.

On March 24, 2021, FBI agents executed a search warrant at SHARP’s residence in Portland, Oregon, and seized certain electronic devices, including the laptop used by the employee to steal the company’s data. 

It has been estimated that the publication of stolen data caused the drop of the company’s stock price pf approximately 20%, between approximately March 30, 2021, and March 31, 2021. The company lost over $4 billion in market capitalization.  SHARP also attempted to trigger an investigation by domestic and foreign regulators with false allegations about the security breach he secretly caused.

SHARP has been also sentenced to three years of supervised release and ordered to pay restitution of $1,590,487 and to forfeit personal property used or intended to be used in connection with these offenses.

We are in the final!

Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections where is reported Securityaffairs or my name Pierluigi Paganini

Please nominate Security Affairs as your favorite blog.

Nominate Pierluigi Paganini and Security Affairs here here: https://docs.google.com/forms/d/e/1FAIpQLSepvnj8b7QzMdLh7vWEDQDqohjBUsHyn3x3xRdYGCetwVy2DA/viewform

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, cybercrime)