The U.S. District Court in Seattle sentenced ShinyHunters member Sebastien Raoult to three years in prison and ordered a restitution of $5,000,000.
Previously, in September 2023, Raoult pleaded guilty to conspiracy to commit wire fraud and aggravated identity theft, facing a maximum punishment of 27 years in prison.
Raoult, a 22-year-old from France, is known online as ‘Sezyo Kaizen’ and was part of the ShinyHunters hacking group. He was arrested in Morocco in 2022 and extradited to the U.S. in January 2023.
Between April 2020 and July 2021, Raoult and his co-conspirators caused financial damages exceeding $6 million, resulting from the theft of the personal information of millions of people and their sale on the dark web.
Raoult lured victims with specially crafted phishing pages that mimicked the login portals of their targets’ employers, tricking them into entering their account credentials and other sensitive data.
Next, members of the ShinyHunters group used the stolen credentials to log in to company systems and steal all data they could access in the corporate network, cloud instances, and even systems of third-party service providers.
“The lengths to which Mr. Raoult and his co-conspirators went to steal personal and financial information are remarkably devious, and he played a substantial part in the scheme by creating code and phishing websites,” commented FBI agent Richard A. Collodi.
ShinyHunters used this corporate access to steal data from over 60 organizations, including personally identifiable information and financial details of millions of people.
Next, the hackers threatened to leak or sell that data on platforms like the RaidForums, EmpireMarket, and Exploit if the victimized company didn’t pay them a ransom.
Source: BleepingComputer
In many cases, the hackers followed through with their threats, leaking data publicly to expose customers’ data and cause reputation and financial damage to the firms.
“For over two years, Mr. Raoult participated in extensive computer hacking that caused millions of dollars in losses to victim companies and unmeasurable additional losses to hundreds of millions of individuals whose data was sold to other criminals,” said Criminal Chief Sarah Vogel.
“Mr. Raoult’s motive was pure greed. He sold hacked data. He stole people’s cryptocurrency. He even sold his hacking tools so that he could profit while other hackers attacked additional victims.
Raoult expressed repentance about his former activities, promising never to engage in hacking again.
“I understand my mistakes, and I want to put that part behind me. No more hacking. I don’t want to disappoint my family again,” said Raoult during his sentencing.
Raoult can be out on supervised release in about ten months, as the time spent in detention in Morocco and the U.S. is credited towards his three-year sentence.