UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF GEORGIA NEWNANDP/ISION RLED IN OPEN COURT U.S.D.C.-Atlanta -2 a^TTEN, Clerk Deputy Clerk JAMES
n.DlC^M&l UKH^^"^ni
IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF GEORGIA
NEWNANDP/ISION
RLED IN OPEN COURT
U.S.D.C.-Atlanta
-2
a^TTEN, Clerk
Deputy Clerk
JAMES
B\
UNITED
V.
ROBERT
A.K.A.
A.K.A.
A.K.A.
STATES OF AMERICA
PTOBECK/
//LIFELOCK//;
//STUDMASTER//;
//STUDMASTERl"
Criminal Indictment
No. U 8
THE GRANfD JURY CHARGES THAT:
BACKGROUND
At all times relevant to this Indictment:
1. Victim-1 is a medical clinic located in Griffin/ Georgia/ within the
Northern District of Georgia. Victim-1 maintains a repository of
personally identifiable information and confidential personal health
information/ to include patient records/ full names/ addresses/ social
security numbers/ and birth dates. This mformation is confidential and
stored on restricted/ nonpublic servers located in Griffin/ Georgia and
elsewhere.
2. The City of Newnan is a city in Metro Atlanta and the county seat of
Coweta County/ Georgia/ within the Northern District of Georgia.
3. As a part of its ordinary course of operations/ the City of Newnan
maintains a large repository of documents and reports/ including police
reports containing sensitive personally identifiable information/ such as
full names/ addresses/ social security numbers/ and birth dates. This
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 1 of 16
information is confidential and stored on restricted/ nonpublic servers
located in Newnan/ Georgia and elsewhere.
4. Victim-2 is a medical practice located in Locust Grove/ Georgia/
within the Northern District of Georgia. Victim-2 also maintains a
repository of personally identifiable mformation and confidential personal
health information/ to include patient records/ full names/ addresses/ social
security numbers/ and birth dates. This information is confidential and
stored on restricted, nonpublic servers located in Locust Grove/ Georgia
and elsewhere.
5. Victim-3 is an orthodontist in Wellington/ Florida. Victim-3 also
maintains a repository of personally identifiable information and
confidential personal health information/ to include patient records/ full
names/ addresses/ social security numbers/ and birth dates. This
information is confidential and stored on restricted/ nonpublic servers
located in Wellmgton/ Florida and elsewhere.
6. The defendant/ ROBERT PURBECK/ a.k.a. //Lifelock// a.k.a.
//Studmaster// a.ka. //Studmasterl// resides in or around Meridian/ Idaho.
Victim-1 Data Breach
7. On or about June 23,2017, the defendant/ ROBERT PURBECK/ a.ka.
//Lifelock// a.k.a. //Studmaster// a.k-a. //Studmasterl// purchased access
credentials/ namely a usemame and password/ to a computer server
belonging to Victim-1 on a criminal marketplace.
8. On or about June 25,2017, PURBECK then used these stolen access
credentials to access protected computers of Victim-1 without
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 2 of 16
authorization/ maintained unauthorized access to those computers/ and
stole medical records and other documents that contained sensitive
personally identifiable information of over 43/000 individuals/ including
names/ addresses/ birth dates/ and social security numbers.
City of Newnan Data Breach
9. On or about February 9/ 2018, the defendant/ ROBERT PURBECK/
a.k.a. //Lifelock/ a.k.a. //Studmaster/ a.k.a. Studmasterl/ purchased
access credentials/ namely a usemame and password/ to a City of Newnan
Police Department computer server on a criminal marketplace.
10. On or about the same day/ PURBECK then used these stolen access
credentials to access protected computers of the City of Newnan without
authorization/ maintained unauthorized access to those computers/ and
stole police reports and other internal documents that contained sensitive
personally identifiable information of over 14/000 individuals/ including
names/ addresses/ birth dates/ and social security numbers.
Victim-2 Data Breach
11. On or about April 28,2018, the defendant/ ROBERT PURBECK/
a.k.a. //Lifelock// a.k.a. //Studmaster/ a.k.a. Studmasterl/ purchased
access credentials/ namely a usemame and password/ to a computer server
belonging to Victim-2 on a criminal marketplace.
12. On or about the same day/ PURBECK then used these stolen access
credentials to access protected computers of Victim-2 without
authorization/ maintained unauthorized access to those computers/ and
stole medical records and other documents that contained sensitive
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 3 of 16
personally identifiable information of over 7/000 individuals/ mcluding
names/ addresses/ birth dates/ and social security numbers.
Victim-3 Data Breach and Attempted Extortion
13. On or about June 18,2018, the defendant/ ROBERT PURBECK/ a.k.a.
i
//Lifelock// a.k.a. //Studmaster/ a.k.a. / I
credentials/ namely a usemame and password/ to a computer server
belonging to Victun-3 on a criminal marketplace.
14.PURBEQC then used the stolen access credentials to access protected
computers of Victim-3 without authorization/ maintained unauthorized
access to those computers/ and stole medical records and other documents
that contained sensitive personally identifiable information of over 1/800
individuals/ including names/ addresses/ birth dates/ and social security
numbers.
15. From on or about July 3/ 2018 through on or about July 9/ 2018,
PURBECK threatened/ harassed/ and attempted to extort Victim-3/
demanding a ransom payment in Bitcoin. PURBECK threatened to disclose
and sell the patient and personal information stolen from Victim-3 unless
Victim-3 paid the ransom demand. PURBECK also identified the names
and social security numbers of Victim-3/s minor children and threatened to
disclose and seU their personal information as well.
16. During the course of this attempted extortion/ PURBECK sent
numerous harassing e-mails and text messages to Victim-3 and Victim-3 s
patients.
4
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 4 of 16
COUNTS ONE THROUGH THREE
(Computer Fraud and Abuse - Unauthorized Access)
17. The Grand Jury re-aUeges and incorporates by reference
I ;^
paragraphs 1 through 16 of this Indictment as if fuUy set forth herein.
18. On or about the dates listed m Column A of the table below/ in the
Northern District of Georgia/ and elsewhere/ the defendant/ ROBERT
PUKBECK/ a.k.a. "Lifelock/" a.k.a. "Studmaster/ a.k.a. "Studmasterl/
aided and abetted by others unknown to the Grand Jury/ intentionally
accessed a protected computer of each of the victims listed in Column B
without authorization/ and thereby obtained information from a protected
computer/ including names/ addresses/ birth dates/ and social security
numbers/ for purposes of commercial advantage and private financial
gain/ with the value of such information exceeding $5/000:
Count
1
2
3
A
Date
June 25,2017
February 9,2018
April 28,2018
B
Victim
Victim-1
City of Newnan
Victim-2
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 5 of 16
All in violation of Title 18, United States Code/ Sections 1030(a)(2)(C)/
1030(c)(2)(B)(i) and 1030(c)(2)(B)(iii) and Section 2.
COUNT FOUR
(Computer Fraud and Abuse - Extortion of Victim-3)
19. The Grand Jury re-alleges and incorporates by reference paragraphs
1 through 16 of tihis Indictment as if fully set forth herein.
20. From on or about June 18, 2018, and continumg through on or about
July 9/ 2018, m the Northern District of Georgia/ Southern District of
Florida/ and elsewhere/ the defendant/ ROBERT PURBECK/ a.k.a.
//Lifelock/ a.k.a. Studmaster/ a.k.a. Studmasterl/ aided and abetted by
others unknown to the Grand Jury/ with intent to extort from any person/
namely Victim-3/ any money and other Uiings of value/ namely funds in
Bitcoin/ transmitted in interstate and foreign commerce/ mcluding through
the Northern District of Georgia/ a communication containing a threat to
obtain information from a protected computer without authorization and
to impair the confidentiality of information obtained from a protected
computer without authorization/ all in violation of Title 18, United States
Code/ Sections 1030(a)(7)(B) and 1030(c)(3)(A) and Section 2.
COUNTS HVE THROUGH EIGHT
(Wire Fraud)
21. The Grand Jury re-alleges and incorporates by reference
paragraphs 1 through 16 of this Indictment as if ftdly set forth herein.
22. On or about the dates listed in Column A of the table below/ m the
Northern District of Georgia and elsewhere/ the defendant/ ROBERT
6
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 6 of 16
PURBECK, a.ka. "LifelocV a.k.a. //Studmaster// a.k.a. "Studmasterl/"
aided and abetted by others unknown to the Grand Jirry/ having
knowingly devised and intending to devise a scheme and artifice to
defraud and to obtain money and property by means of materially false
and fraudulent pretenses/ representations/ and promises/ did with intent to
defraud cause the transmission by means of wire communication in
interstate and foreign commerce of certain writings/ signs/ signals/
pictures/ and sounds/ that is/ the wire transmission listed in Column B/
issued from m or around Meridian/ Idaho/ to computer servers located in
the Northern District of Georgia/ as specified in Column C/ for the purpose
of executing such scheme and artifice:
Count
5
6
7
8
A
Date
June 25,2017
February 9/ 2018
April 28,2018
July 3,2018
B
Wire Transmission
RDP Login.; .
RDP Login ;
RDP Login '
E-Mail from
PURBECKto
Victim-3
c
Victim
Victim-1
Ciiy of Newnan
Victim-2
Victim-3
All in violation of Title 18, United States Code/ Section 1343 and Section 2.
COUNTS NINE THROUGH ELEVEN
(Access Device Fraud)
23. The Grand Jury re-alleges and incorporates by reference
paragraphs 1 through 16 of this Indictment as if fuUy set forth herein.
24. On or about the dates Hsted in Column A of the table below/ m the
Northern District of Georgia/ and elsewhere/ the defendant/ ROBERT
7
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 7 of 16
PURBECK/ a.k.a. //Lifelock// a.k.a. //Studmaster// a.k.a. //Studmasterl//
aided and abetted by others unknown to the Grand Jury/ did knowingly
and with intent to defraud/ use and traffic in unauthorized access devices/
namely access credentials consisting of a usemame and password/ of the
victims listed in Column B/ and by such conduct/ obtained things of value
worth $1/000 or more in a one-year period/ said use and trafficldng
affecting interstate and foreign commerce/ in violation of Title 18, United
States Code/ Sections 1029(a)(2) and (c)(l)(A)(i) and Section 2.
Count
9
10
11
A
Date
June 25,2017
February 9/ 2018
AprU28/2018
B
Victim
Victim-1
City of Newnan
Victim-2
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 8 of 16
FORFEITURE PROVISION
25. Upon conviction of one or more of the offenses alleged in Counts
One through Four of this Indictment/ the defendant/ ROBERT PURBECK/
a.k.a. //Lifelock// a.k.a. //Studmaster// a.k.a. //Studmasterl/ shall forfeit to
the United States/ pursuant to Title 18, United States Code/ Section
982(a)(2)(B) and Title 18, United States Code/ Section 1030(i)/ any property/
real or personal/ constit-uting/ or derived from/ proceeds obtained/ directly
or indirectly/ as a result of said violations and any personal property that
was used or intended to be used to commit or to facilitate the commission
of the violations/ including/ but not Umited to/ those items listed in
Attachment //A// together with a personal forfeiture money judgment/ that
is/ a sum of money in United States currency representing the amount of
proceeds obtained as a result of each offense alleged in Counts One
through Four of this Indictment
26. Upon conviction of one or more of the offenses alleged in Counts
Five through Eight of this Indictment/ the defendant/ ROBERT PURBECK/
a.k.a. //Lifelock/ a.k.a. Studmaster/ a,k.a. //Studmasterl/ shall forfeit to
the United States/ pursuant to Title 18, United States Code/ Section
981(a)(l)(C) and Title 28, United States Code/ Section 2461(c)/ any and all
property/ real or personal/ which constitutes or is derived from proceeds
traceable to said violations/ including/ but not limited to/ those items listed
in Attachment A/7 and a money judgment representing the amount of
proceeds obtained as a result of said violations aUeged in Counts Five
through Eight of this Indictment. ;
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 9 of 16
27. Upon conviction of one or more of the offenses aUeged in Counts
Nine through Eleven of this Indictment/ the defendant/ ROBERT
PURBECK/ a.ka. //Lifelock// a.k.a. //Studmaster// a.k.a. //Studmasterl//
shaU forfeit to the United States/ pursuant to Title 18, United States Code/
Section 982(a)(2)(B)/ any property constituting/ or derived from/ proceeds
obtained directly or indirectly as a result of said violations/ including/ but
not limited/ to a money judgment representing the amount of proceeds
obtained as a result of the offenses/ as alleged in Counts Nine through
Eleven of this Indictment/ and pursuant to Title 18, United States Code/
Section 1029(c)/ any personal property used or intended to be used to
commit said violations/ including but not limited to/ those items listed in
Attachment "A//
28. If any of the above-described forfeitable property/ as a result of any
act or omission of the defendant
a. cannot be located upon the exercise of due diligence;
b. has been transferred or sold to/ or deposited with/ a third party;
c. has been placed beyond the jurisdiction of the court;
d. has been substantially dimmished in value; or
e. has been commmgled with other property which cannot be divided
without difficulty/
10
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 10 of 16
the United States intends/ pursuant to Title 21, United States Code/ Section
853(p)/ as incorporated by Title 18, United States Code/ Section 982(b) and
Title 18, United States Code/ Section 1030(i)/ to seek forfeiture of any other
property of said defendant up to the value of the above forfeitable
property.
A l^iA.^. _ BILL
.tVl^a^ /. 4L)^J.U^^^
FOREPERSON
KURT R. ERSKINE
Acting United States Attorney
MICHAEL HERSKOWITZ'
Assistant United States Attorney
Georgia Bar No. 349515
^n T ^fe!wA
NATHAN KITCHENS
Assistant United States Attorney
Georgia Bar No. 263930
600 US. Courthouse
75 Ted Turner Drive SW
Atlanta/ GA 30303
404-581-6000
11
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 11 of 16
Attachment A
• SEAGATE BACKUP PLUS HARD DmVE P/N 2AWAP7-500 SN'
NA9W63A3; CORSAIR FLASH DRWE SLIDER Xl 128G;
• SEAGATE TOWER SNNA8B08G5 (HARD DRIVE);
• MICRO NICHE USB THUMB DRIVE;
» RAVEN TOWER BS14140564RVZ01BO;
< SEAGATE SN6RW1DOZ6;
• 3 CELL PHONES:
o Black Motorola Droid Razr XT912/
o White Samsung Galaxy Prevail LTESM-G360P/and
o Black LH Smartphone LS740 SN 410CYWC0584857;
• RASBERRY PI COMPUTER;
• 1 TEIUMB DRT^E -American life USB drive;
• 1 GB MEMORY CAED - EMC Isolon Flash Drive 4 GB;
• 2 USB MEMORY DEVICES:
o American life USB drive/ and
o EMCIsolon Flash Drive 4GB;
• 2 STORAGE DEVICES WCC4E6VE56PR AND KUCJ05A156;
• ALCATEL CELL PHONE A574BL;
• IPHONE 7 A1660 AND IMPACT STRONG CASE;
• BLACK IPHONE 8 PLUS A1897 WITH OTTERBOX CASE;
• SONY LAPTOP SN #275268339019447;
• 4 MEMORY DEVICES:
o 480 GBSanDisk Extreme 500,
12
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 12 of 16
o 8 GBPNY Attache USB 2.0,
o SanDisk Cruzer Micro 2 GB/ and
o Porsche Driver's Selection Key Shaped USB Flash Drive;
• MAC BOOK PRO SNC02JKT67D853;
• HP Z240 TOWER SNZVA6060RF1;
• BLACK IPHONE 8 A1905 WITH CASEMATE CASE;
* HP 2230 TOWER SN2VA42217QC;
• HP LAPTOP BUTE BOOK;
• 12HARDDRWES;
• WCC4M52CLXNV MY CLOUD;
• 3 DISKS;
• BARRACUDASN3J80K884;
• WESTERN DIGFTAL HARD DRIVE SNWCAZA3882835;
• HP LAPTOP SN5CG3291267;
• TOSHIBA LATOPSN37251406K;
• 2 SQUARE READERS;
< 5THUMBDRWES;
• 8GBSANDISK;
• 1 CD;
• IPHONE;
• 2 THUMB DRIVES/SEAGATE HARDRIVESN9VP924SV;
• BARACUDASN3T80KRM6;
• 2 MOTOROLA XT912 CELL PHONTES - BLACK MOTOROLA DROID
RAZOR XT912;
13
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 13 of 16
• SEAGATE HSN9VY55295;
• 2 CD'S;
• THUMB DRIVE -PNYUSB 34GB GRAY;
* HP LAPTOP SN: CNF0135R2C;
• DELL LAPTOP SN: F1TSYB1;
• K-NET TOWER;
• IPAD 16 GB SN: F5RKT7DEDFHW; . ...
• KINDLE-BLACK AMAZON KINDLE D01400;
» APPLE LAPTOP SN: WQ024D5JATM; \
»
• ACER ASPERE LAPTOP SN:LXR4R0200203758A4 21601; '
» SONY LAPTOP SN:C3LPQ45Y;
• MAXTOR HARD DRTVE SN: E1JNSF3E;
• MAXTOR HARD DRWE S/N E1K3JWBE;
» 16 GIG MICRO SDCAED;
• DELL LAPTOP BITCOIN MINER- DELL LATITUDE E5400 S/N
BVX1LK1;
• HP MINI LAPTOP S/NCNF005CHH7;
• SUPERDISKS/NAA9812154230M;
• CD CASH FLOW 202 C3122JK2322663LH;
» CANON COMPACT FLASH TM CARD PC 16M;
• CD G/BACKUP 0024B3N306005;
• CD A5D22C2225094;
• HP INVENT SN25D626T1FF;
» SEAGATE SN3FTOP7YM;
14
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 14 of 16
• SEAGATE SN5M02N7KQ;
• QUANTUM SN 172933813920;
» GALAXY 2DSN6QF39MSF;
• HTTACm DESK STAR MODEL HDS722580VL5A80;
• SEAGATE SN9QM48JBV;
o SEAGATE SN9QM48C6F;
o MOBILE READER REGISTER;
• CARD READER;
» GIFT CARDS:
o 12 American Express Credit
o 1 Black Rock Coffee
o 20 Blank
o 1 Boost Mobile
o 1 Buffalo Wild Wings
o 3 Cabelas
o 1 Coldstone
o 2 Cracker Barrel
o 1 Disney
o 1DXL
o 611 eBay
o 1 Gamestop
o 8 Home Depot
o i mop
o 4 iTunes
15
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 15 of 16
o 20 Kroger Credit
o ILyft
o 1 Mastercard Credit
o 2PitaPit
o 1 PlayStation
o 1 Red Robin
o 1 Sears
o 2 Southwest
o 9529 Starbucks
o 1 Subway
o 42 Target
o 4 Visa Credit
o 5 Visa Gift
o 1 Walgreens
o 1 Walmart
o 2 Whole Foods
I • ,
o 1 Xbox . . • !
o 1 Dominos ~ -
33 Credit Cards issued to Robert Purbeck or Silk Alpaca
16
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 16 of 16
IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF GEORGIA
NEWNANDP/ISION
RLED IN OPEN COURT
U.S.D.C.-Atlanta
-2
a^TTEN, Clerk
Deputy Clerk
JAMES
B\
UNITED
V.
ROBERT
A.K.A.
A.K.A.
A.K.A.
STATES OF AMERICA
PTOBECK/
//LIFELOCK//;
//STUDMASTER//;
//STUDMASTERl"
Criminal Indictment
No. U 8
THE GRANfD JURY CHARGES THAT:
BACKGROUND
At all times relevant to this Indictment:
1. Victim-1 is a medical clinic located in Griffin/ Georgia/ within the
Northern District of Georgia. Victim-1 maintains a repository of
personally identifiable information and confidential personal health
information/ to include patient records/ full names/ addresses/ social
security numbers/ and birth dates. This mformation is confidential and
stored on restricted/ nonpublic servers located in Griffin/ Georgia and
elsewhere.
2. The City of Newnan is a city in Metro Atlanta and the county seat of
Coweta County/ Georgia/ within the Northern District of Georgia.
3. As a part of its ordinary course of operations/ the City of Newnan
maintains a large repository of documents and reports/ including police
reports containing sensitive personally identifiable information/ such as
full names/ addresses/ social security numbers/ and birth dates. This
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 1 of 16
information is confidential and stored on restricted/ nonpublic servers
located in Newnan/ Georgia and elsewhere.
4. Victim-2 is a medical practice located in Locust Grove/ Georgia/
within the Northern District of Georgia. Victim-2 also maintains a
repository of personally identifiable mformation and confidential personal
health information/ to include patient records/ full names/ addresses/ social
security numbers/ and birth dates. This information is confidential and
stored on restricted, nonpublic servers located in Locust Grove/ Georgia
and elsewhere.
5. Victim-3 is an orthodontist in Wellington/ Florida. Victim-3 also
maintains a repository of personally identifiable information and
confidential personal health information/ to include patient records/ full
names/ addresses/ social security numbers/ and birth dates. This
information is confidential and stored on restricted/ nonpublic servers
located in Wellmgton/ Florida and elsewhere.
6. The defendant/ ROBERT PURBECK/ a.k.a. //Lifelock// a.k.a.
//Studmaster// a.ka. //Studmasterl// resides in or around Meridian/ Idaho.
Victim-1 Data Breach
7. On or about June 23,2017, the defendant/ ROBERT PURBECK/ a.ka.
//Lifelock// a.k.a. //Studmaster// a.k-a. //Studmasterl// purchased access
credentials/ namely a usemame and password/ to a computer server
belonging to Victim-1 on a criminal marketplace.
8. On or about June 25,2017, PURBECK then used these stolen access
credentials to access protected computers of Victim-1 without
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 2 of 16
authorization/ maintained unauthorized access to those computers/ and
stole medical records and other documents that contained sensitive
personally identifiable information of over 43/000 individuals/ including
names/ addresses/ birth dates/ and social security numbers.
City of Newnan Data Breach
9. On or about February 9/ 2018, the defendant/ ROBERT PURBECK/
a.k.a. //Lifelock/ a.k.a. //Studmaster/ a.k.a. Studmasterl/ purchased
access credentials/ namely a usemame and password/ to a City of Newnan
Police Department computer server on a criminal marketplace.
10. On or about the same day/ PURBECK then used these stolen access
credentials to access protected computers of the City of Newnan without
authorization/ maintained unauthorized access to those computers/ and
stole police reports and other internal documents that contained sensitive
personally identifiable information of over 14/000 individuals/ including
names/ addresses/ birth dates/ and social security numbers.
Victim-2 Data Breach
11. On or about April 28,2018, the defendant/ ROBERT PURBECK/
a.k.a. //Lifelock// a.k.a. //Studmaster/ a.k.a. Studmasterl/ purchased
access credentials/ namely a usemame and password/ to a computer server
belonging to Victim-2 on a criminal marketplace.
12. On or about the same day/ PURBECK then used these stolen access
credentials to access protected computers of Victim-2 without
authorization/ maintained unauthorized access to those computers/ and
stole medical records and other documents that contained sensitive
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 3 of 16
personally identifiable information of over 7/000 individuals/ mcluding
names/ addresses/ birth dates/ and social security numbers.
Victim-3 Data Breach and Attempted Extortion
13. On or about June 18,2018, the defendant/ ROBERT PURBECK/ a.k.a.
i
//Lifelock// a.k.a. //Studmaster/ a.k.a. / I
credentials/ namely a usemame and password/ to a computer server
belonging to Victun-3 on a criminal marketplace.
14.PURBEQC then used the stolen access credentials to access protected
computers of Victim-3 without authorization/ maintained unauthorized
access to those computers/ and stole medical records and other documents
that contained sensitive personally identifiable information of over 1/800
individuals/ including names/ addresses/ birth dates/ and social security
numbers.
15. From on or about July 3/ 2018 through on or about July 9/ 2018,
PURBECK threatened/ harassed/ and attempted to extort Victim-3/
demanding a ransom payment in Bitcoin. PURBECK threatened to disclose
and sell the patient and personal information stolen from Victim-3 unless
Victim-3 paid the ransom demand. PURBECK also identified the names
and social security numbers of Victim-3/s minor children and threatened to
disclose and seU their personal information as well.
16. During the course of this attempted extortion/ PURBECK sent
numerous harassing e-mails and text messages to Victim-3 and Victim-3 s
patients.
4
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 4 of 16
COUNTS ONE THROUGH THREE
(Computer Fraud and Abuse - Unauthorized Access)
17. The Grand Jury re-aUeges and incorporates by reference
I ;^
paragraphs 1 through 16 of this Indictment as if fuUy set forth herein.
18. On or about the dates listed m Column A of the table below/ in the
Northern District of Georgia/ and elsewhere/ the defendant/ ROBERT
PUKBECK/ a.k.a. "Lifelock/" a.k.a. "Studmaster/ a.k.a. "Studmasterl/
aided and abetted by others unknown to the Grand Jury/ intentionally
accessed a protected computer of each of the victims listed in Column B
without authorization/ and thereby obtained information from a protected
computer/ including names/ addresses/ birth dates/ and social security
numbers/ for purposes of commercial advantage and private financial
gain/ with the value of such information exceeding $5/000:
Count
1
2
3
A
Date
June 25,2017
February 9,2018
April 28,2018
B
Victim
Victim-1
City of Newnan
Victim-2
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 5 of 16
All in violation of Title 18, United States Code/ Sections 1030(a)(2)(C)/
1030(c)(2)(B)(i) and 1030(c)(2)(B)(iii) and Section 2.
COUNT FOUR
(Computer Fraud and Abuse - Extortion of Victim-3)
19. The Grand Jury re-alleges and incorporates by reference paragraphs
1 through 16 of tihis Indictment as if fully set forth herein.
20. From on or about June 18, 2018, and continumg through on or about
July 9/ 2018, m the Northern District of Georgia/ Southern District of
Florida/ and elsewhere/ the defendant/ ROBERT PURBECK/ a.k.a.
//Lifelock/ a.k.a. Studmaster/ a.k.a. Studmasterl/ aided and abetted by
others unknown to the Grand Jury/ with intent to extort from any person/
namely Victim-3/ any money and other Uiings of value/ namely funds in
Bitcoin/ transmitted in interstate and foreign commerce/ mcluding through
the Northern District of Georgia/ a communication containing a threat to
obtain information from a protected computer without authorization and
to impair the confidentiality of information obtained from a protected
computer without authorization/ all in violation of Title 18, United States
Code/ Sections 1030(a)(7)(B) and 1030(c)(3)(A) and Section 2.
COUNTS HVE THROUGH EIGHT
(Wire Fraud)
21. The Grand Jury re-alleges and incorporates by reference
paragraphs 1 through 16 of this Indictment as if ftdly set forth herein.
22. On or about the dates listed in Column A of the table below/ m the
Northern District of Georgia and elsewhere/ the defendant/ ROBERT
6
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 6 of 16
PURBECK, a.ka. "LifelocV a.k.a. //Studmaster// a.k.a. "Studmasterl/"
aided and abetted by others unknown to the Grand Jirry/ having
knowingly devised and intending to devise a scheme and artifice to
defraud and to obtain money and property by means of materially false
and fraudulent pretenses/ representations/ and promises/ did with intent to
defraud cause the transmission by means of wire communication in
interstate and foreign commerce of certain writings/ signs/ signals/
pictures/ and sounds/ that is/ the wire transmission listed in Column B/
issued from m or around Meridian/ Idaho/ to computer servers located in
the Northern District of Georgia/ as specified in Column C/ for the purpose
of executing such scheme and artifice:
Count
5
6
7
8
A
Date
June 25,2017
February 9/ 2018
April 28,2018
July 3,2018
B
Wire Transmission
RDP Login.; .
RDP Login ;
RDP Login '
E-Mail from
PURBECKto
Victim-3
c
Victim
Victim-1
Ciiy of Newnan
Victim-2
Victim-3
All in violation of Title 18, United States Code/ Section 1343 and Section 2.
COUNTS NINE THROUGH ELEVEN
(Access Device Fraud)
23. The Grand Jury re-alleges and incorporates by reference
paragraphs 1 through 16 of this Indictment as if fuUy set forth herein.
24. On or about the dates Hsted in Column A of the table below/ m the
Northern District of Georgia/ and elsewhere/ the defendant/ ROBERT
7
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 7 of 16
PURBECK/ a.k.a. //Lifelock// a.k.a. //Studmaster// a.k.a. //Studmasterl//
aided and abetted by others unknown to the Grand Jury/ did knowingly
and with intent to defraud/ use and traffic in unauthorized access devices/
namely access credentials consisting of a usemame and password/ of the
victims listed in Column B/ and by such conduct/ obtained things of value
worth $1/000 or more in a one-year period/ said use and trafficldng
affecting interstate and foreign commerce/ in violation of Title 18, United
States Code/ Sections 1029(a)(2) and (c)(l)(A)(i) and Section 2.
Count
9
10
11
A
Date
June 25,2017
February 9/ 2018
AprU28/2018
B
Victim
Victim-1
City of Newnan
Victim-2
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 8 of 16
FORFEITURE PROVISION
25. Upon conviction of one or more of the offenses alleged in Counts
One through Four of this Indictment/ the defendant/ ROBERT PURBECK/
a.k.a. //Lifelock// a.k.a. //Studmaster// a.k.a. //Studmasterl/ shall forfeit to
the United States/ pursuant to Title 18, United States Code/ Section
982(a)(2)(B) and Title 18, United States Code/ Section 1030(i)/ any property/
real or personal/ constit-uting/ or derived from/ proceeds obtained/ directly
or indirectly/ as a result of said violations and any personal property that
was used or intended to be used to commit or to facilitate the commission
of the violations/ including/ but not Umited to/ those items listed in
Attachment //A// together with a personal forfeiture money judgment/ that
is/ a sum of money in United States currency representing the amount of
proceeds obtained as a result of each offense alleged in Counts One
through Four of this Indictment
26. Upon conviction of one or more of the offenses alleged in Counts
Five through Eight of this Indictment/ the defendant/ ROBERT PURBECK/
a.k.a. //Lifelock/ a.k.a. Studmaster/ a,k.a. //Studmasterl/ shall forfeit to
the United States/ pursuant to Title 18, United States Code/ Section
981(a)(l)(C) and Title 28, United States Code/ Section 2461(c)/ any and all
property/ real or personal/ which constitutes or is derived from proceeds
traceable to said violations/ including/ but not limited to/ those items listed
in Attachment A/7 and a money judgment representing the amount of
proceeds obtained as a result of said violations aUeged in Counts Five
through Eight of this Indictment. ;
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 9 of 16
27. Upon conviction of one or more of the offenses aUeged in Counts
Nine through Eleven of this Indictment/ the defendant/ ROBERT
PURBECK/ a.ka. //Lifelock// a.k.a. //Studmaster// a.k.a. //Studmasterl//
shaU forfeit to the United States/ pursuant to Title 18, United States Code/
Section 982(a)(2)(B)/ any property constituting/ or derived from/ proceeds
obtained directly or indirectly as a result of said violations/ including/ but
not limited/ to a money judgment representing the amount of proceeds
obtained as a result of the offenses/ as alleged in Counts Nine through
Eleven of this Indictment/ and pursuant to Title 18, United States Code/
Section 1029(c)/ any personal property used or intended to be used to
commit said violations/ including but not limited to/ those items listed in
Attachment "A//
28. If any of the above-described forfeitable property/ as a result of any
act or omission of the defendant
a. cannot be located upon the exercise of due diligence;
b. has been transferred or sold to/ or deposited with/ a third party;
c. has been placed beyond the jurisdiction of the court;
d. has been substantially dimmished in value; or
e. has been commmgled with other property which cannot be divided
without difficulty/
10
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 10 of 16
the United States intends/ pursuant to Title 21, United States Code/ Section
853(p)/ as incorporated by Title 18, United States Code/ Section 982(b) and
Title 18, United States Code/ Section 1030(i)/ to seek forfeiture of any other
property of said defendant up to the value of the above forfeitable
property.
A l^iA.^. _ BILL
.tVl^a^ /. 4L)^J.U^^^
FOREPERSON
KURT R. ERSKINE
Acting United States Attorney
MICHAEL HERSKOWITZ'
Assistant United States Attorney
Georgia Bar No. 349515
^n T ^fe!wA
NATHAN KITCHENS
Assistant United States Attorney
Georgia Bar No. 263930
600 US. Courthouse
75 Ted Turner Drive SW
Atlanta/ GA 30303
404-581-6000
11
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 11 of 16
Attachment A
• SEAGATE BACKUP PLUS HARD DmVE P/N 2AWAP7-500 SN'
NA9W63A3; CORSAIR FLASH DRWE SLIDER Xl 128G;
• SEAGATE TOWER SNNA8B08G5 (HARD DRIVE);
• MICRO NICHE USB THUMB DRIVE;
» RAVEN TOWER BS14140564RVZ01BO;
< SEAGATE SN6RW1DOZ6;
• 3 CELL PHONES:
o Black Motorola Droid Razr XT912/
o White Samsung Galaxy Prevail LTESM-G360P/and
o Black LH Smartphone LS740 SN 410CYWC0584857;
• RASBERRY PI COMPUTER;
• 1 TEIUMB DRT^E -American life USB drive;
• 1 GB MEMORY CAED - EMC Isolon Flash Drive 4 GB;
• 2 USB MEMORY DEVICES:
o American life USB drive/ and
o EMCIsolon Flash Drive 4GB;
• 2 STORAGE DEVICES WCC4E6VE56PR AND KUCJ05A156;
• ALCATEL CELL PHONE A574BL;
• IPHONE 7 A1660 AND IMPACT STRONG CASE;
• BLACK IPHONE 8 PLUS A1897 WITH OTTERBOX CASE;
• SONY LAPTOP SN #275268339019447;
• 4 MEMORY DEVICES:
o 480 GBSanDisk Extreme 500,
12
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 12 of 16
o 8 GBPNY Attache USB 2.0,
o SanDisk Cruzer Micro 2 GB/ and
o Porsche Driver's Selection Key Shaped USB Flash Drive;
• MAC BOOK PRO SNC02JKT67D853;
• HP Z240 TOWER SNZVA6060RF1;
• BLACK IPHONE 8 A1905 WITH CASEMATE CASE;
* HP 2230 TOWER SN2VA42217QC;
• HP LAPTOP BUTE BOOK;
• 12HARDDRWES;
• WCC4M52CLXNV MY CLOUD;
• 3 DISKS;
• BARRACUDASN3J80K884;
• WESTERN DIGFTAL HARD DRIVE SNWCAZA3882835;
• HP LAPTOP SN5CG3291267;
• TOSHIBA LATOPSN37251406K;
• 2 SQUARE READERS;
< 5THUMBDRWES;
• 8GBSANDISK;
• 1 CD;
• IPHONE;
• 2 THUMB DRIVES/SEAGATE HARDRIVESN9VP924SV;
• BARACUDASN3T80KRM6;
• 2 MOTOROLA XT912 CELL PHONTES - BLACK MOTOROLA DROID
RAZOR XT912;
13
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 13 of 16
• SEAGATE HSN9VY55295;
• 2 CD'S;
• THUMB DRIVE -PNYUSB 34GB GRAY;
* HP LAPTOP SN: CNF0135R2C;
• DELL LAPTOP SN: F1TSYB1;
• K-NET TOWER;
• IPAD 16 GB SN: F5RKT7DEDFHW; . ...
• KINDLE-BLACK AMAZON KINDLE D01400;
» APPLE LAPTOP SN: WQ024D5JATM; \
»
• ACER ASPERE LAPTOP SN:LXR4R0200203758A4 21601; '
» SONY LAPTOP SN:C3LPQ45Y;
• MAXTOR HARD DRTVE SN: E1JNSF3E;
• MAXTOR HARD DRWE S/N E1K3JWBE;
» 16 GIG MICRO SDCAED;
• DELL LAPTOP BITCOIN MINER- DELL LATITUDE E5400 S/N
BVX1LK1;
• HP MINI LAPTOP S/NCNF005CHH7;
• SUPERDISKS/NAA9812154230M;
• CD CASH FLOW 202 C3122JK2322663LH;
» CANON COMPACT FLASH TM CARD PC 16M;
• CD G/BACKUP 0024B3N306005;
• CD A5D22C2225094;
• HP INVENT SN25D626T1FF;
» SEAGATE SN3FTOP7YM;
14
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 14 of 16
• SEAGATE SN5M02N7KQ;
• QUANTUM SN 172933813920;
» GALAXY 2DSN6QF39MSF;
• HTTACm DESK STAR MODEL HDS722580VL5A80;
• SEAGATE SN9QM48JBV;
o SEAGATE SN9QM48C6F;
o MOBILE READER REGISTER;
• CARD READER;
» GIFT CARDS:
o 12 American Express Credit
o 1 Black Rock Coffee
o 20 Blank
o 1 Boost Mobile
o 1 Buffalo Wild Wings
o 3 Cabelas
o 1 Coldstone
o 2 Cracker Barrel
o 1 Disney
o 1DXL
o 611 eBay
o 1 Gamestop
o 8 Home Depot
o i mop
o 4 iTunes
15
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 15 of 16
o 20 Kroger Credit
o ILyft
o 1 Mastercard Credit
o 2PitaPit
o 1 PlayStation
o 1 Red Robin
o 1 Sears
o 2 Southwest
o 9529 Starbucks
o 1 Subway
o 42 Target
o 4 Visa Credit
o 5 Visa Gift
o 1 Walgreens
o 1 Walmart
o 2 Whole Foods
I • ,
o 1 Xbox . . • !
o 1 Dominos ~ -
33 Credit Cards issued to Robert Purbeck or Silk Alpaca
16
Case 3:21-cr-00004-UNA Document 1 Filed 03/02/21 Page 16 of 16
