Slashdot Mirror
Man To Pay $300,000 In Damages For Hacking Employer (bbc.com)
An anonymous reader writes: A former private security officer in California must pay nearly $319,000 in damages for attacking his employer's computer systems. Yovan Garcia accessed payroll records at Security Specialists, which provides private security patrols, to inflate the number of hours he had worked. He later hacked the firm's servers to steal data and defaced its website. District Judge Michael Fitzgerald said Garcia had used the stolen data to help set up a rival business. Security Specialists first noticed issues with Mr Garcia's pay records in July 2014, about two years after he joined. In one example, they showed he had worked 12 hours per day over a two-week period and was owed 40 hours of overtime pay, when in fact he only worked eight hours per day.
When I was a kid those of us that worked at 'Worlds of Fun' (an amusement park in Kansas City) discovered that their computerized payroll was STUPID.
We never clocked out and got paid for 24 hours/day, 7 days/week. Some on the night grounds crew slept under the bridges, others and the day crew bought themselves season passes to exit and enter as customers (you couldn't get out the employee route without clocking out). Good times.
Eventually they figured it out (it wasn't still going on 3 years later, when my younger brother worked there), but there were no consequences. Even though it had to be easy to find with a computerized report.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
Lawyers do that all the time.
A lawyer dies and ends up at the Pearly Gates. St. Peter is REALLY impressed.
"Why sir, based up on your billable hours, you died when you were 212 years old. Step right in!"
and I was only playing a game, your honor
On the surface, this seems like such a stupid thing to do. It makes you wonder, though, the few cases like this we actually hear about must be in the minority, meaning people are getting away with stuff like this all the time. What leads a person to grow up to be so morally compromised as to think this kind of behaviour is acceptable?
Mr Garcia had obtained login credentials - without ever having been given them
You mean he guessed the password. That's not "hacking," and if somebody was able to cause that much damage to your systems by not only guessing at a single set of credentials, but continuing to use them after his termination on grounds of illegitimately accessing computer resources, then you are by no means a "security" firm.
Chk a chk ahhh...
Weaselmancer
rediculous.
A GOOD hacker would have covered his tracks so they didn't get caught..
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
According to the Central District Court of California, Mr Garcia had obtained login credentials - without ever having been given them - and accessed the records without authorisation
So just using an account you are not authorized for is now hacking? It doesn't require circumvention or bypass of technical systems or finding interesting edge cases in the rules of the system any more? Sad.
After he agreed to pay $319,000, the man claimed he accidentally made some mistake and paid back twice. He demands the former employer check his computer systems and if they find $638,000 credit from First Magical Bank of Lalaland, dated 2017 Feb 30, confirmation number 123412341234 they must return the "excess" payment.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Too frosty for you snowflakes?
my brother worked for did it to him at least once. He's clever (not enough to avoid fucking his life up so hard he worked at a series of small computer shops, but I digress), so he caught it every time, but usually when he got hired on the other two or three employees had the same done to them for years and the boss didn't stop until they were called out. The most common scam is working them through lunch for free. Usually with a cheap pizza to shut them up. But rounding "errors" were popular too.
Most of the time big businesses don't do this because of class action lawsuits. I worked for a call center that was doing it for years and got nailed by one (I think they've all been nailed for it at least once at this point). What sucks is with the new laws allowing arbitration agreements to be binding plus a few nasty supreme court rulings class action lawsuits are pretty much a thing of the past. Sure, it sucks that the lawyers were the only ones that got a real payout, but at least after the suit companies stopped the bullshit. Now it's full steam ahead. Things are gonna get ugly in the next 20 years.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Considering he was able to use the data he took to launch a business of his own, $319K is a bargain. I mean, that's a cost of doing business expense if that's all he has to pay.
Anons need not reply. Questions end with a question mark.
It's quite obvious that their processes were so poor that it could not even protect them from fraud. What this guys did was wrong, but frankly, as so called 'Security Specialists' they deserve it.
It's interesting to observe that there are still no damages against companies who maintain the same poor security when it leaks their customers identity data.
I wonder how quickly these security issues would be fixed if these companies could not litigate for damages causes by their own nonfeasance.
My ism, it's full of beliefs.
Okay, not really the same thing.