Canadian hacker pleads guilty in 2014 Yahoo hacking case

A Canadian hacker by the name Karim Baratov has pleaded guilty to hacking charges related to a 2014 Yahoo data breach.

Baratov, 22, is the only person who has been arrested so far in connection with the breach that compromised nearly 500 million user accounts. He was born in Kazakhstan, but is a Canadian citizen. The Justice Department charged him and three others including two officers in Russia’s Federal Security Service, or FSB, for their roles in the breach.

Baratov admitted that his role was to "hack webmail accounts of individuals of interest" to the FSB, the Russian internal security service. He then sent those passwords to his alleged co-conspirator, Dmitry Aleksandrovich Dokuchaev.

"The illegal hacking of private communications is a global problem that transcends political boundaries," said United States Attorney Brian Stretch in a statement. "Cybercrime is not only a grave threat to personal privacy and security, but causes great financial harm to individuals who are hacked and costs the world economy hundreds of billions of dollars every year."

Prosecutors said the FSB officers, Dmitry Dokuchaev and Igor Sushchin, directed and paid hackers to obtain information and used Alexsey Belan, who is among the Federal Bureau of Investigation’s most-wanted cyber criminals, to breach Yahoo.

When the FSB officers learned that a target had a non-Yahoo email account, including through information obtained from the Yahoo hack, they worked with Baratov, who was who paid to break into at least 80 email accounts.

According to his testimony, Baratov placed ads for his services on Russian-language websites. Once contracted, he gained access to his victims’ accounts by spearphishing them with faked correspondences designed to appear as though they were sent from the relevant email host.