IT admin fleeced Expedia for $330k in insider trading scam

Support technician admits using network credentials to access execs' confidential files

A former Expedia senior IT support technician has pleaded guilty to accessing confidential company files and illegally using the information within for insider trading that netted him over $300,000.

Jonathan Ly, 28, pleaded guilty to securities fraud, which began in 2013 and continued even after he left the company in 2015.

Advertisement - Article continues below

FBI special agent in charge Jay S Tabb Jr said Ly's behaviour was was "particularly egregious because [he] abused his special access privileges as an IT administrator". 

"On top of violating the trust of the public and his company, he violated the privacy of fellow employees by surreptitiously accessing their files," Tabb continued.

A court document detailing the case against Ly notes that, as part of his role as a senior IT support technician, he was given "certain administrative access privileges that could be used to remotely access electronic files on Expedia employees' electronic devices", as well as, from time to time, being given corporate network passwords.

In a summary of how the scheme worked, the document states that between 2013 and 2015 Ly "secretly and fraudulently accessed the contents of Expedia executives' computer files and corporate email accounts to ... [collect information] in order to execute a series of well-timed and lucrative securities trades in Expedia options".

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Ly left Expedia in April 2015, but, unknown to the company, took with him an Expedia laptop that he used to continue accessing corporate systems and email and carry out his insider trading.

Commenting on the case, Rui Melo Biscaia, director of product management at Watchful Software, said: "This case demonstrates how much damage malicious insiders can cause, especially when armed with a high level of privilege and little oversight.

"The threat of trusted insiders abusing their positions can be greatly reduced by ensuring that confidential files can only be access by the authorised user themselves. Internal support staff that are able to access other users' machines should only be able to access files and network areas relevant to their current job, rather than having free reign over information that would normally be highly restricted. Classifying and encrypting all confidential files against unauthorised access will also help protect against external attackers that are able to gain control of a system."

Advertisement - Article continues below

The US Department of Justice praised Expedia for its "quick reporting" of the intrusion once it was detected, which made it easier for the FBI to trace the malicious behaviour back to Ly.

In total, Ly made over $331,000 from the fraudulent trades. He is scheduled to be sentenced on 28 February next year and could face up to 25 years in prison and a $250,000 fine.

Main image credit: Bigstock

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now
Advertisement

Recommended

Visit/security/ransomware/356292/university-of-california-gets-fleeced-by-hackers-for-114-million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Visit/security/cyber-security/356289/australia-announces-135b-investment-in-cybersecurity
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
Visit/cloud/cloud-security/356288/csa-and-issa-form-cybersecurity-partnership
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020
Visit/business/policy-legislation/356215/senators-propose-a-bill-aimed-at-ending-warrant-proof-encryption
Policy & legislation

Senators propose a bill aimed at ending warrant-proof encryption

24 Jun 2020

Most Popular

Visit/business/business-operations/356395/nvidia-overtakes-intel-as-most-valuable-us-chipmaker
Business operations

Nvidia overtakes Intel as most valuable US chipmaker

9 Jul 2020
Visit/laptops/29190/how-to-find-ram-speed-size-and-type
Laptops

How to find RAM speed, size and type

24 Jun 2020
Visit/security/cyber-attacks/356417/trump-confirms-cyber-attacks-on-russia-election-trolls
cyber attacks

Trump confirms US cyber attack on Russia election trolls

13 Jul 2020