‘Lifelock’ hacker pleads guilty to extorting medical clinics

An Idaho man who hacked and extorted medical clinics and a police department pleaded guilty on Tuesday in Georgia federal court to charges of computer fraud and abuse. 

Robert Purbeck, who used the aliases “Lifelock” and “Studmaster,” stole the personal information of more than 130,000 people, according to a release from the Northern District of Georgia announcing the guilty plea. In 2017 and 2018, he purchased stolen credentials on the dark web and hacked into the networks of a medical clinic in Griffin, Georgia and the police department of the nearby city of Newnan. He targeted at least 17 other victims, the DOJ said.

“Purbeck… used these stolen credentials to hack into the city’s computer systems and steal records consisting of police reports and documents, which included personal information of more than 14,000 people,” they said.

At the time of Purbeck’s indictment in 2021, prosecutors alleged that he also stole personal information from a medical practice in Locust Grove, Georgia, and from an orthodontist in Florida, who he then allegedly tried to extort by threatening to sell personal information related to the orthodontist’s underage child and by sending emails and text messages to patients. 

“Purbeck breached computer systems in our district and across the country, stole vast amounts of personal information, and aggravated his crimes by weaponizing sensitive data in an egregious attempt to extort his victims,” said U.S. Attorney Ryan K. Buchanan. “Cyber-attacks on health care facilities and local governments pose a grave risk to the security of personal information.”  

Before his arrest, a man using the hacker name Lifelock corresponded with the website DataBreaches.net about a breach of an eye surgery center in Holland, Michigan. 

The hacker reportedly demanded a ransom from the clinic, and when the ransom went unpaid and the theft of information unreported, Lifelock implored the DataBreaches administrator to “Please find a way to let the people of Holland know that they have been breached and that the people who swore a hippocratic oath to do no harm, have done them immense harm.” The center eventually reported the breach, allegedly two years after the incident. 

Purbeck will be sentenced in June and as part of his plea agreement will pay $1 million in restitution to victims. 

Correction: A previous version of this article misspelled the name of a city in Georgia. It is Newnan, not Newman.