Personal information for more than 100,000 employees of several federal agencies--including the U.S. Department of Health and Human Services--was obtained illegally by an alleged British hacker, indicted late last week by the U.S. Attorney's Office for the Eastern District of Virginia for conspiracy, access device fraud and aggravated identity theft, among a bevy of charges.
According to the indictment, the alleged hacker--29-year-old Lauri Love--took advantage of a vulnerability in Adobe ColdFusion that allowed him and his conspirators to access information including names, Social Security numbers, addresses, phone numbers and salary data without login credentials.
Love--who already has been indicted two other times in the past 10 months--faces up to 10 years in prison if convicted. Announcement