Federal authorities last week arrested five men in connection with a 2005 network breach at LexisNexis Group that the database giant said led to the theft of personal records on more than 310,000 individuals.
The government charges that the men, who range in age from 19 to 24, used stolen database accounts to look up sensitive data on a number of individuals. The victims are named only by their initials in the indictment, but some of the accused men said in interviews with washingtonpost.com that the case involves the theft last year of revealing photos and other information from hotel heiress Paris Hilton's cellphone.
The group also used stolen or illegally created accounts at LexisNexis subsidiaries to look up Social Security numbers and other personal information on dozens of celebrities, according to the suspects who were interviewed.
Charged in the indictment with aggravated identify theft, conspiracy and computer fraud were: Jason Daniel Hawks, 24, of Winston-Salem, N.C.; Zachary Wiley Mann, 19, of Maple Grove, Minn.; Timothy C. McKeage, 21, of Woonsocket, R.I.; Justin A. Perras, 19, of New Bedford, Mass.; and Jeffrey Robert Weinberg, 21, of Laguna Beach, Calif.
Aggravated identity theft is defined as the use of a stolen identity to commit other crimes. Under a law passed in July 2004, someone found guilty of aggravated identity theft receives a mandatory two-year prison sentence in addition to any penalties for related crimes.
The government alleges that on two dates in January and March 2005, McKeage compromised a computer belonging to an officer in the Port Orange, Fla., Police Department. He then allegedly used the department's credentials to access records at Accurint, a database service for law enforcement and legal professionals offered by Seisint, a Florida-based subsidiary of LexisNexis. The indictment charges that McKeage used that access to create even more user accounts, which he then allegedly shared with the other co-defendants.
The indictment also alleges that at the same time, Perras gained access to an Accurint account belonging to a police department in Denton County, Tex., by impersonating a LexisNexis employee. According to interviews with at least three of the accused, the group accessed information on Hilton, California Gov. Arnold Schwarzenegger (R), and actors Laurence Fishburne and Demi Moore.
Perras said yesterday that he admitted to U.S. Secret Service agents in February that all of the charges against him in the government's indictment were true. But he said no one in the group used the information obtained through Accurint for illegal purposes.
"There was never any malicious intent," Perras said in a phone interview. "We were just a bunch of kids goofing around. No one was planning on stealing anyone's identities."
In May 2005, police searched the home of one of Perras's friends -- a minor -- in connection with the hacking of Paris Hilton's cellphone. That individual -- whom The Washington Post is not naming because he is still a minor -- is currently serving an 11-month sentence in a Massachusetts juvenile detention center after pleading guilty to his role in the Hilton phone hack, among other charges.
Zachary Mann, another of the young men arrested last week, admitted in a phone interview that he had looked up the personal information of several celebrities, including Fishburne. But he denied that anyone in the group ever tried to profit from any of the information. When asked whether he had any regrets about his actions, Mann was defiant.
"I'd do it safer, because way too many people involved were talking about it," Mann said. "I don't think what we did was that bad. We never used anyone's identity. Besides, don't you think it's wrong that a company like that has all this information that's available to anyone who's willing to pay for it?"
The five men are ordered to appear in a West Palm Beach, Fla., courtroom for a pretrial hearing July 12. All are currently free on bond.
A spokesperson for the Secret Service declined to comment, referring inquiries to the U.S. Atorney's office for the Southern District of Florida, which could not be reached for comment. LexisNexis officials did not return calls seeking comment.