Ex-Employee Sentenced for Stealing Personal Information from the Cloud

Memphis, TN – A Collierville resident has been sentenced to federal prison for computer fraud and aggravated identity theft. U.S. Attorney D. Michael Dunavant for the Western District of Tennessee announced the sentence today.

According to information presented in court, in mid-February 2017, Jeffrey R. Luke’s, 42, employment as a behavioral analyst at Transformations Autism Treatment Center (TACT) in Bartlett, Tennessee, was terminated, as was Luke’s authority to access TACT’s patient records. The records were kept in a password-protected secure Google Drive account. When Luke was dismissed, passwords were changed in order to protect the data.

U.S. Attorney D. Michael Dunavant said: "With new and ever-changing technology, criminals are using more creative and disturbing ways to commit cyber-crimes against vulnerable victims, including identity theft. This case demonstrates the commitment and ability of the U.S. Attorney’s office, working with our federal and local law enforcement partners, to detect compromises of personal and sensitive information and hold offenders accountable for such fraudulent schemes."

However, in March, TACT’s information technology specialist noticed that the email address TACT employees used to log in to Google Drive had been comprised. Investigators identified the Internet protocol (IP) address through which the hack was accomplished, and traced it to Luke’s residence. A search warrant was executed; patient records, forms and templates were found on Luke’s computer hard drive.

On March 2, 2018, Luke was sentenced by U.S. District Judge John T. Fowlkes, Jr. to 30 months imprisonment and 3 years supervised release. He was also ordered to pay $14,941.36 in restitution.

This case was investigated by the FBI and Bartlett Police Department. Assistant U.S. Attorney Deb Ireland prosecuted this case on the government’s behalf.