Systems Administrator Indicted in Hacking Scheme

Filed in archive Malware on January 9, 2008

A systems administrator at health care firm Medco Health Solutions Inc, was sentenced to 30 months in jail for a hacking scheme that involved the planting of a "logic bomb" in the company's server. The "bomb" was designed to delete all the information on Medco's 70 HP-Linux servers, but was derailed twice, once due to a coding error and the second time by an alert administrator. The servers held databases contain prescription info, insurance coverage, prescription call ins from doctors and other critical patient data. Had Andy Lin's scheme worked, it would have prevented pharmacists from checking for drug interactions and patients from filling prescriptions.

"The potential damage to Medco and the patients and physicians served by the company cannot be understated," Christopher Christie, U.S. attorney for the New Jersey district, said in a statement.

Investigators say Lin, 51, planned the scheme as revenge against upcoming layoffs. He pleaded guilty to one count of computer fraud. In addition to his sentence, he was ordered to pay $81,000 in restitution to Medco.

"This case is unique in that it touches on the public health system," Assistant U.S. Attorney Erez Liebermann told Computerworld. "Other logic bomb and intrusion cases have dealt mostly with money. Not to belittle that - it's a very, very serious issue. But they hadn't risen to being a risk to human beings. ... A stiff sentence like this sends the message to companies that it's important to report these crimes, and when you do, the criminal justice system will take this seriously. When companies come forward with these crimes, it's worth their while, and if someone is caught, even in the attempt stage, they will get a stiff sentence."

According to the U.S. Attorney's office, Lin's sentence is the longest federal prison sentence ever given for a crime against a computer system.