Threat Management, Incident Response, Network Security, TDR, Vulnerability Management

Former Gucci insider charged with hacking network

A former network engineer at Gucci has been charged with hacking into the company's network, deleting data and shutting down servers and networks.

Sam Yin, 34, of Jersey City, N.J., used an account he secretly created while employed by the luxury retailer to access the network after he was fired in May 2010, prosecutors said.

In a 50-count indictment, returned Monday, Yin is charged with computer tampering, identity theft, falsifying business records, computer trespassing, criminal possession of computer-related material, unlawful duplication of computer-related material and unauthorized use of a computer. 

He faces up to 15 years in prison, a spokeswoman for the New York County district attorney's office told on Tuesday.

"Computer hacking is not a game,” said New York County District Attorney Cyrus Vance, in a statement. “It is a serious threat to corporate security that can have a devastating effect on personal privacy, jobs and the ability of a business to function at all."

According to prosecutors, Gucci, whose U.S. headquarters are in Manhattan, provides employees with remote access to its virtual private network (VPN) via a USB-token device that is inserted into a computer. During his tenure at the company, Yin created a VPN token in the name of a fictional employee and took it with him after being fired.

Last June, using the fake identity, he emailed members of Gucci's IT department and tricked them into activating the token, prosecutors said.

Then, Yin leveraged his familiarity with Gucci's network architecture and passwords to gain access to the merchant's entire network, prosecutors said.

On Nov. 12, Yin broke into Gucci's network and deleted several virtual servers, shut down a storage area network and erased from an email server a disk containing corporate mailboxes, prosecutors said. As a result, staff members were unable to access documents, files or other materials saved on the company's network. Also, his tampering with the email server cut off email access for corporate staff, store managers and the e-commerce team.

Email was restored by the end of the day but the effects of the intrusion lasted for months, according to prosecutors. Yin's actions cost Gucci more than $200,000 in diminished productivity, restoration and remediation expenses.

Yin's lawyer was not immediately available when contacted by on Tuesday.

The case underscores the importance of following best security practices, Graham Cluley, senior security researcher at anti-virus firm Sophos, wrote in a blog post Tuesday.

“I think the message we should all learn from this sorry case is the importance of reviewing your user database and removing unknowns, changing passwords, and resetting access rights when a member of your staff leaves your employment,” Cluley said.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.