A former Yahoo engineer has pleaded guilty to using his company access to break into thousands of Yahoo user accounts.
On Monday, 34-year-old Reyes Daniel Ruiz admitted in a San Jose federal court to the computer crimes, which focused on obtaining sexual images and videos of young women, including his friends and co-workers. In total, he hacked into about 6,000 Yahoo accounts, according to the US attorney's office for the Northern District of California.
According to federal investigators, Ruiz "cracked" user passwords and took advantage of Yahoo's internal systems to gain access to the accounts. He then copied any images and videos stored inside and kept the data at his home. He also hacked the victims' other accounts at internet services such as iCloud, Facebook, Gmail, and Dropbox.
The indictment against Ruiz claims he began hacking into the accounts around May 2018, which went on for about a month and also involved intercepting emails from 37 Yahoo accounts. A LinkedIn page for Ruiz shows that he worked at Yahoo for more than 10 years, largely on the email service side. He left the company in July 2018.
It appears Yahoo eventually caught on. "After his employer observed the suspicious account activity, Ruiz admitted to destroying the computer and hard drive on which he stored the images," federal investigators said in yesterday's announcement. Yahoo and its parent, Verizon Media, have not commented on the incident, or disclosed how the breaches occurred and what safeguards are in place to prevent employee access abuse.
After leaving Yahoo, Ruiz went to work at Okta, a provider of security technologies on login and identity management services. However, the company terminated his employment once US prosecutors unsealed the indictment against him in April.
"The actions for which he was indicted all happened prior to his employment at Okta. The privacy and security of our customers is our top priority, and immediately upon learning of the indictment, Ruiz's access was revoked and Okta worked with a third party to conduct a forensic analysis, which confirmed that no company or customer data was compromised," Okta said in an email to PCMag.
Ruiz pleaded guilty to one count of computer intrusion. He faces up to five years in prison and a fine of $250,000. His sentencing hearing is scheduled for February.