Calif. IT Contractor Sentenced to 2 Years for Deleting Carlsbad Company’s Microsoft User Accounts
- After he was fired, Deepanshu Kher, an Indian citizen, perpetrated a significant and sophisticated attack on the company, which was planned and clearly intended as revenge.
A California man was sentenced in federal court earlier this week to two years in prison for perpetrating a significant and sophisticated attack on a company he was contracted to work with. Citing court documents, a Department of Justice press release said Deepanshu Kher, who worked in an information technology consulting firm, accessed the server of the Carlsbad company and deleted over 1,200 of its 1,500 Microsoft User Accounts. He worked with the consulting firm from 2017 through May 2018.
In 2017, the consulting firm was hired by the Carlsbad company to assist with its migration to a Microsoft Office 365 (MS O365) environment. In response, the consulting firm sent Kher to the company’s Carlsbad headquarters to assist with the migration.
The company was dissatisfied with Kher’s work and relayed their dissatisfaction to the consulting firm soon after Kher’s arrival. In January 2018, the consulting firm pulled Kher from the company’s headquarters. A few months later, on May 4, 2018, Kher was fired. A month later he returned to Delhi.
On Aug. 8, 2018, two months after his return to India, Kher hacked into the Carlsbad Company’s server and deleted over 1,200 of its 1,500 MS O365 user accounts. The attack affected the bulk of the company’s employees and completely shut down the company for two days. Employees’ accounts were deleted – they could not access their email, their contacts lists, their meeting calendars, their documents, corporate directories, video and audio conferences, and Virtual Teams environment necessary for them to perform their jobs.
Outside the company, customers, vendors and consumers were unable to reach company employees (and the employees were unable to reach them). No one could inform these buyers what was going on or when the company would be operational again. The Carlsbad Company repeatedly handled multitudes of IT problems for three months, the DOJ press release said.
Kher, an Indian national, was arrested when he flew from India to the United States on Jan. 11, unaware of the outstanding warrant for his arrest.
In pronouncing the sentence, U.S. District Court Judge Marilyn L. Huff noted that Kher “perpetrated a significant and sophisticated attack on the company, an attack which was planned and clearly intended as revenge.” In addition to the two years in custody, Judge Huff sentenced Kher to three years’ supervised release and restitution to the company of $567,084, the amount the company paid to fix the problems which Kher caused.