Hackers Plead Guilty to Breaching US Federal Law Enforcement Database for Doxxing

• Two men were charged in March 2023 for hacking into a federal law enforcement Web portal.
• Cybercriminals from a group called ViLe stole sensitive data that they used for doxxing.
• The defendants pleaded guilty to computer intrusion and aggravated identity theft.

Two individuals belonging to a cybercriminal group called ViLE were arrested and pleaded guilty to computer intrusion and aggravated identity theft after breaching the online portal of a U.S. federal law enforcement agency and using the stolen data to intimidate and ultimately extort victims.

In federal court in Brooklyn, Sagar Steven Singh, also known as “Weep”, 20, from Rhode Island, pled guilty on Monday to conspiring to commit computer intrusion and aggravated identity theft. On May 30, 2024, Nicholas Ceraolo, also known as “Convict,” “Anon” and “Ominous,” 26, from New York, pled guilty to the same offenses.

The Attorney’s Office says the defendants and their co-conspirators “exploited vulnerabilities within government databases,” mentioning the individuals used a law enforcement officer’s stolen password to access a private database. Communications belonging to Singh proved he had “jacked into a police officer’s account” and gained “access to gov databases.”

The data belonged to a password-protected website maintained by a U.S. federal law enforcement agency. The portal contained detailed, nonpublic records of narcotics and currency seizures and law enforcement intelligence reports.

Defendants sought to collect victims’ personal information, including social security numbers, then posted or threatened to post all the non-public details on a public website administered by a ViLE member. The cybercriminals would then ask for payment to remove victim information from the said website, and they even threatened victims’s families with physical harm.

Singh asked for a victim’s credentials for Instagram accounts, insinuating he could harm the victim’s parents since he had their social security number, driver’s license number, home address, and other personal details. He then bullied the person into selling their own accounts and offering the proceedings to him.