Former Shionogi Employee Admits to Hack Attack on Company Servers

NEWARK, NJ—A Georgia man who froze the operations of a New Jersey pharmaceutical company where he had worked by deleting portions of its computer network pleaded guilty this morning, admitting he executed the attack, U.S. Attorney Paul J. Fishman announced.

Jason Cornish, 37, of Smyrna, Ga., pleaded guilty to an information charging him with knowingly transmitting computer code with the intent to damage computers in interstate commerce. Cornish entered his guilty plea before U.S. District Judge Stanely R. Chesler in Newark federal court.

According to documents filed in this case and statements made in court:

Cornish was an information technology employee at Shionogi, Inc., a United States subsidiary of a Japanese pharmaceutical company with operations in New Jersey and Georgia. In late September 2010, shortly after Cornish had resigned from Shionogi, the company announced layoffs that would affect an individual identified in court documents as B.N., Cornish’s close friend and former supervisor.

In the early morning hours of February 3, 2011, Cornish gained unauthorized access to Shionogi’s computer network. Cornish used a Shionogi user account to access a Shionogi server, then took control of a piece of software that he had secretly installed on the server several weeks earlier.

Cornish then used the secretly installed software program to delete the contents of each of 15 “virtual hosts” on Shionogi’s computer network. These 15 virtual hosts (subdivisions on a computer designed to make it function like several computers) housed the equivalent of 88 different computer servers. Cornish used his familiarity with Shionogi’s network to identify each of these virtual hosts by name or by its corresponding Internet Protocol address.

The deleted servers housed most of Shionogi’s American computer infrastructure, including the company’s e-mail and Blackberry servers, its order tracking system, and its financial management software. The attack effectively froze Shionogi’s operations for a number of days, leaving company employees unable to ship product, cut checks, or communicate by e-mail. Shionogi sustained approximately $800,000 in losses responding to the attack, conducting damage assessments, and restoring the company’s network to its prior condition.

The investigation by the FBI’s Cyber Crimes Task Force revealed that the attack originated from a computer connected to the wireless network of a Smyrna McDonald’s where Cornish had used his credit card to make a purchase minutes before the attack. Cornish also gained unauthorized access to Shionogi’s network from his home Internet connection using administrative passwords to which he had access as an employee.

The charge to which Cornish pleaded guilty carries a maximum potential penalty of 10 years in prison and a $250,000 fine. Sentencing is currently scheduled for November 10, 2011.

U.S. Attorney Fishman thanked special agents of the FBI’s Cyber Crimes Task Force, under the direction of Special Agent in Charge Michael B. Ward in Newark; and in Atlanta, under the direction of Special Agent in Charge Brian D. Lamkin, with the investigation leading to the guilty plea.

The government is represented by Assistant U.S. Attorney Seth B. Kosto of the U.S. Attorney’s Office Computer Hacking and Intellectual Property Section in the Office’s Economic Crimes Unit in Newark.