Idaho man calling himself ‘Studmaster’ hacked information from 65,000 people, feds say
The personal information of more than 65,000 people in two states was compromised when someone hacked into the computer systems of two medical practices, an entire city and an orthodontist’s office, federal prosecutors said.
Now a man from Idaho who goes by the name “Studmaster” online has been charged.
Robert Purbeck — also known as “Lifelock” or “Studmaster” — was indicted last week on computer and wire fraud charges in the U.S. District Court for the Northern District of Georgia, the U.S Attorney’s Office said Friday in a news release. Purbeck is from Meridian, just outside of Boise.
“The theft of intellectual property to be used to extort citizens is a very serious crime and one the FBI will diligently pursue, no matter if you are hiding behind a computer screen,” Special Agent in Charge Chris Hacker said in the release.
Purbeck could not be reached for comment Monday, and the name and contact information of his defense attorney was not readily available.
According to the indictment, the alleged hacks occurred between June 2017 and July 2018.
During that time, prosecutors said Purbeck bought the usernames and passwords to computer servers in Georgia and Florida from a “criminal marketplace.”
On June 25, 2017, he is accused of using those credentials to hack into a medical clinic’s computers in Griffin, Georgia, which is about an hour north of Macon. Purbeck then stole medical records and other personally identifiable information from roughly 43,000 people, according to the indictment.
On Feb. 9, 2018, prosecutors said Purbeck hacked the City of Newnan, a suburb of Atlanta.
Using the login credentials for the city police department, he’s accused of stealing police reports and other records that contained the names, addresses, birth dates and social security numbers of more than 14,000 people, the indictment states.
On April 28, 2018, prosecutors said, Purbeck got into the computer system of a medical practice in Locust Grove, Georgia — about 20 minutes from neighboring Griffin, where the first hack is said to have occurred.
This time, the medical records and other documents containing the personally identifiable information of at least 7,000 people were stolen, according to the indictment.
About two months later, Purbeck is accused of using stolen login credentials for the final time on an orthodontist in Wellington, Florida, roughly 72 miles north of Miami.
After he reportedly stole medical records from more than 1,800 patients at the practice, Purbeck tried to extort the orthodontist by demanding ransom money in the form of Bitcoin, prosecutors said.
Over six days in July 2018, he threatened to sell patients’ personal information if the ransom was not met, the indictment states. Purbeck is also accused of threatening to expose the names and social security numbers of the orthodontist’s children.
“During the course of this attempted extortion, Purbeck allegedly sent numerous harassing e-mails and text messages to the orthodontist and his patients,” prosecutors said.
It wasn’t immediately clear Monday how federal investigators connected Purbeck — who lives thousands of miles away in Idaho — to the alleged hacking incidents in Georgia and Florida. He was indicted by a grand jury on March 2 and charged with computer fraud and abuse, access device fraud and wire fraud.
Purbeck had not been arrested as of Monday, court documents show.
If he’s convicted, prosecutors have asked Purbeck to forfeit anything from computers and cell phones to gift cards from at least 30 restaurants and retailers — including Cracker Barrel, GameStop, Pita Pit, Starbucks, Sears, Target and Walmart.
