UPMC To Pay Multimillion Dollar Settlement In Data Breach Case

PITTSBURGH, PA — UPMC will pay $2.65 million to settle a class-action lawsuit filed by employees whose identities were compromised in a 2014 data breach that resulted in the filing of bogus income tax returns.

The settlement was approved Thursday by an Allegheny County Common Pleas Court Judge.

UPMC denied any wrongdoing in the case, filed on behalf of more than 65,000 employees.

In May, Justin Sean Johnson, 30, of Detroit pleaded guilty to to two federal charges related to the scheme, which involved hacking into the UPMC human resource server databases and stealing sensitive personal identifiable and W-2 information of UPMC workers.

Johnson, known on the dark web as the TheDearthStar, sold the information to others who filed hundreds of false 1040 tax returns claiming hundreds of thousands of dollars of false tax refunds that were converted into Amazon gift cards. Merchandise purchased with the cards was shipped to Venezuela.

Johnson, who has yet to be sentenced, faces up to five years in prison and a $250,000 fine.

Be the first to know what's happening in your community and region. With a free Patch subscription, you'll always be up to date on local and state news: https://patch.com/subscribe.