A security company executive has been charged for hacking into (PDF) the Gwinnett Medical Center’s network on or around September 27th, 2018. According to the Department of Justice, Vikas Singla from Georgia conducted a cyberattack on the not-for-profit network of healthcare providers in part for commercial advantage and personal financial gain. Singla was the chief operating officer of a network security company in metro-Atlanta — the DOJ didn’t name the company, but the profile matches that of Securolytics — that served the healthcare industry. He (and his yet-to-be-named associates) allegedly disrupted GMC’s phone service, obtained information from a digitizing device and disrupted network printer service during the attack.

While the DOJ didn’t dive into the specifics of the case, it was reported back in 2018 that GMC was investigating a possible data breach that led to the leak of patient information online. The attackers also threatened GMC’s staff and shamed the provider on the internet. Now-deleted blog posts on Securolytics’ website written by Singla describe attacking targets in healthcare, presumably to fix problems with their security. How that activity is linked to the data breach reported in 2018, or the charges filed this week, is still unclear.

The executive was indicted by a federal grand jury on June 8th and was charged with 17 counts of intentional damage to a protected computer, with each charge carrying a maximum sentence of 10 years in prison. He was also charged with one count of obtaining information by computer from a protected computer, which has a max sentence of five years in prison.

Special Agent in Charge Chris Hacker of the FBI’s Atlanta Field Office said:

“This cyberattack on a hospital not only could have had disastrous consequences, but patients’ personal information was also compromised. The FBI and our law enforcement partners are determined to hold accountable, those who allegedly put people’s health and safety at risk while driven by greed.”