'Crafty Cockney' hacker gets five years in US 'rusty nail'

A British man, who who went by the online alias “Crafty Cockney” and was a member of a hacking gang that stole UK hospital patients’ records as well as carrying out a raft of ransomware attacks on business, has been banged up for five years in the US.

Nathan Wyatt from Wellingborough, Northamptonshire, was first arrested by UK police in 2016 on suspicion of hacking the iCloud account of Pippa Middleton, the sister of the Duchess of Cambridge, to access private images.

He was released without charge in that case in September 2017, only to be rearrested and then plead guilty to 20 counts of fraud, holding a fake passport and blackmail.

It then emerged that Wyatt was a key member of the so-called Dark Overlord hacking collective, behind a raft of ransomware attacks. In December last year, he was extradited to the States and has been held at St Charles County jail in Missouri ever since. Wyatt is the only member of the gang to have been fingered; the rest remain at large.

US prosecutors alleged that Wyatt was involved in attacks against four unnamed healthcare companies in 2016, and a public accounting firm “whose owner received an email that contained personal information about his family and business, with a threat to publish unless 250 bitcoins were paid”.

In one case, the attackers combined corporate data with information about the company’s owner to blackmail to the owner’s family members. They also threatened to publish stolen data from another firm unless it agreed to pay $75,000, only to post the sensitive information on Twitter.

Wyatt’s role in the scheme was to create email and phone accounts that he used to threaten victims, according to the US Department of Justice.

During the hearing, held via Zoom, it emerged that Wyatt had contacted victims to ask for payments, and was caught through a telephone number which linked him to the crime.

He admitted the group had obtained sensitive data from companies, and threatened to release the data unless the companies paid a ransom of between $75,000 (£58,000) and $350,000.

The crew also published unreleased episodes of the Netflix show “Orange Is The New Black” after Netflix paid a ransom in 2017, forced school closures by threatening students and their families, and last year published stolen legal documents related to the 9/11 terrorist attacks.

Acting US Assistant Attorney General Brian C Rabbitt told the hearing: “Nathan Wyatt used his technical skills to prey on Americans’ private data and exploited the sensitive nature of their medical and financial records for his own personal gain.”

Wyatt reportedly said: “I’d like to apologise for the role that I played in this. I can promise you that I just want to go home to my family. I’m out of that world, and I don’t want to see another computer for the rest of my life.”

He pleaded guilty to one count of conspiracy against the US. Two other charges, aggravated identity theft and threatening damage to a protected computer, were dropped.

Even so, Wyatt must now serve five years in jail – or “rusty nail” as Cockney slang would have it – and is also subject to three years of supervised release following his prison term. He was also ordered to pay more than $1m to the Dark Overlord’s victims.