Man hacks law enforcement database to extort victim and threaten family, US feds say

Two men hacked into a federal law enforcement database with a police officer’s stolen password, and one accessed the portal’s sensitive data to extort a victim and threaten their parents, prosecutors said.

Sagar Steven Singh, 20, of Rhode Island, and Nicholas Ceraolo, 26, of New York, now face certain prison time, according to the US Attorney’s Office for the Eastern District of New York.

Attorneys separately representing both men didn’t immediately respond to requests for comment from McClatchy News on June 18.

Singh and Ceraolo are accused cybercriminals and members of “ViLe”, a group known for obtaining victims’ personal information to “harass, threaten or extort” them – otherwise known as “doxxing”, court documents say.

The group – which uses an illustration of a hanging girl’s body as its logo – tries to collect victims’ Social Security numbers and other data to post, or threaten to post publicly online, according to prosecutors, who said victims “could pay” to prevent this from happening.

‘You’re gonna comply’

On May 7, 2022, Singh used a police officer’s login information to access a nonpublic federal law enforcement agency’s website, according to prosecutors.

The portal has “detailed, nonpublic records of narcotics and currency seizures, as well as law enforcement intelligence reports” and shares intelligence with local law enforcement agencies, prosecutors said.

It belongs to the Drug Enforcement Administration, VICE reported in March 2023

The day Singh accessed the portal, Singh messaged Ceraolo about breaching it, and Ceraolo wrote back saying “were all gonna get raided one of these days i swear,” court documents say.

Ceraolo’s statement would prove true for Singh a few months later in September 2022, when Homeland Security agents executed a search warrant of his Rhode Island home, according to a federal complaint.

On May 8, 2022 Singh told Ceraolo: “Im going to jail…that (expletive) portal I accessed I shouldn’t have been there…Im no gov official,” according to court documents.

That day, Ceraolo shared the police officer’s stolen login information with others before Singh went on to extort a victim in an effort to access their Instagram credentials, prosecutors said.

Singh messaged the victim, saying he’d hurt their family unless they handed over the login information to their Instagram accounts, according to prosecutors. He showed them he had their Social Security number, driver’s license number, address and other private information, prosecutors said.

“You’re gonna comply to me if you don’t want anything negative to happen to your parents…I have every detail involving your parents…allowing me to do whatever I desire to them in malicious ways,” Singh warned, as detailed in the complaint.

Singh also said “he had ‘access to…databases, which are federal, through (the) portal, i can request information on anyone in the US doesn’t matter who, nobody is safe’,” the complaint says.

He instructed the victim to sell access to the Instagram accounts and give him the money, according to prosecutors.

Both Singh and Ceraolo knew accessing the portal was illegal, with Singh telling one person the database had “potent tools,” prosecutors said.

Guilty pleas

In March 2023, Singh and Ceraolo were charged with conspiring to commit computer intrusion and aggravated identity theft, prosecutors said.

Singh pleaded guilty on June 17 to both charges, and Ceraolo did so on May 30, the US Attorney’s office announced in a news release.

“The defendants called themselves ‘ViLe’, and their actions were exactly that,” US Attorney Breon Peace said in the release.

The men “along with their co-conspirators, exploited vulnerabilities within government databases for their own personal gain”, said HSI New York Special Agent in Charge Ivan J. Arvelo.

Ceraolo also once impersonated a Bangladeshi police officer to gain information of people subscribed to online service providers by hacking into the officer’s account between February 2022 and May 2022, prosecutors said a March 2023 release.

He caused one social media platform to give him information about a subscriber by claiming the person was involved in “child extortion”, blackmail and “threatened officials of the Bangladeshi government”, prosecutors said.

Around the same time, Ceraolo also targeted an online gaming platform in an attempt to gain information about one of the company’s users, according to prosecutors.

His efforts, which involved using the Bangladeshi police officer’s account, were unsuccessful, prosecutors said.

Singh and Ceraolo face a minimum of two years in federal prison and up to seven years in prison, according to the US Attorney’s office. – The Charlotte Observer/Tribune News Service gggg

Man taunted college students with stolen nude photos from their Snapchats, feds say

Ex-FBI agent told woman she was on ‘secret probation’ to scam her out of $700K, feds say

Inmate extorts health care workers into paying him $15K in phone fraud scheme, feds say

©2024 The Charlotte Observer