Former Employee of Global Financial Services Company Charged with Unauthorized Access of Supervisor’s E-Mail Account on Approximately 100 Occasions
Preet Bharara, the United States Attorney for the Southern District of New York, and Diego Rodriguez, Assistant Director-in-Charge of the New York Field Office of the Federal Bureau of Investigation (“FBI”), announced today the unsealing of a complaint charging KRISTOPHER ROCCHIO with computer fraud, stemming from his repeated unauthorized access of his former supervisor’s e-mail account from at least August 2013 through in or about February 2015. ROCCHIO was arrested this morning, and will be presented in Manhattan federal court before Magistrate Judge Ronald L. Ellis later today.
According to the allegations contained in the criminal complaint1 unsealed today in Manhattan federal court:
From February 2008 through March 2012, ROCCHIO was employed by a global fixed-income financial services company with an office in New York, New York (the “Company”). While employed by the Company, ROCCHIO had a direct supervisor (the “Supervisor”). During ROCCHIO’s employment, the Supervisor never gave ROCCHIO permission to read the Supervisor’s e-mail account at the Company (the “Supervisor’s e-mail”), and never knowingly gave ROCCHIO the password to the Supervisor’s e-mail.
In March of 2012, ROCCHIO left the Company. On or about February 25, 2015, the Supervisor received an e-mail bounce back message to the Supervisor’s e-mail. The message indicated that an e-mail sent from the Supervisor’s e-mail could not be delivered (the “Failed e-mail”). The Supervisor had not personally attempted to send the Failed e-mail. The Supervisor then checked the sent mail folder of the Supervisor’s e-mail and noticed two e-mails in the folder that the Supervisor had not personally sent. One e-mail was the Failed e-mail. The other e-mail (the “February 25 e-mail”) was sent to another e-mail address (the “e-mail Account”). The content of both the Failed e-mail and the February 25 e-mail was the same, and included a password-protected attachment that detailed, among other things, the compensation and performance evaluations for numerous employees at the Company. Later that same day, the Supervisor checked the sent mail folder of the Supervisor’s e-mail again, but both the Failed e-mail and the February 25 e-mail had been deleted by someone other than the Supervisor.
FBI agents reviewed records from the e-mail Account and learned that the subscriber for the e-mail Account is ROCCHIO. The e-mail Account contains the February 25 e-mail. The e-mail Account also contains an earlier e-mail from the Supervisor’s e-mail sent on or about December 21, 2013 (the “December 21 e-mail”). The December 21 e-mail has an attachment, which is a PowerPoint presentation that contained internal metrics of the Company. Also on or about December 21, 2013, the e-mail Account forwarded the December 21 e-mail to an e-mail account associated with ROCCHIO (“e-mail Account-2”) at another financial services company in New York, New York (“Company-2”). e-mail Account-2 then forwarded the December 21 e-mail to another employee at Company-2. Company-2 employed ROCCHIO from May 2013 through July 2015.
Records of remote access to the Supervisor’s e-mail reveal a number of IP addresses used to access the Supervisor’s e-mail. Three of the IP addresses—which collectively accessed the Supervisor’s e-mail at least 79 times—were assigned to ROCCHIO. One of the IP addresses—which accessed the Supervisor’s e-mail at least 15 times—was assigned to Company-2. One of the IP addresses that accessed the Supervisor’s e-mail was assigned to a hotel in Chicago, Illinois, where ROCCHIO was staying at the time of the access into the Supervisor’s e-mail.
ROCCHIO, 38, of Staten Island, New York, is charged with two counts of computer fraud, in violation of Title 18, United States Code, Section 1030. Each count carries a maximum penalty of five years in prison. The statutory maximum sentences are prescribed by Congress and are provided here for informational purposes only, as any sentence imposed on the defendant will be determined by the Court.
Mr. Bharara praised the outstanding efforts of the FBI and its New York Cyber Division.
The case is being prosecuted by the Office’s Complex Frauds and Cybercrime Unit. Assistant United States Attorney Megan Gaffney is in charge of the prosecution.
The charges contained in the Complaint are merely accusations and the defendant is presumed innocent unless and until proven guilty.
1As the introductory phrase signifies, the entirety of the text of the Complaint, and the descriptions of the Complaint set forth herein, constitute only allegations, and every fact described should be treated as an allegation.