IT worker deletes former employer's virtual servers

A US man has pled guilty to causing $300,000 worth of losses to his former employer by wiping almost all of the company's virtualised IT infrastructure.

Jason Cornish, 37, admitted the attack, which he launched from a McDonald's restaurant in Georgia, to a New Jersey district court on Tuesday. A former IT worker for the US subsidiary of the Japanese pharmaceutical firm Shionogi, he had resigned in mid-2010 but was kept on as a consultant until September of that year.

A friend of Cornish's, named in court documents as 'B.N.', was fired in October 2010 for refusing to return certain passwords.

The attack took place on 3 February 2011, when Cornish — having quietly installed VMware's vSphere on a Shionogi server weeks earlier — used the virtualisation tool to delete all 15 virtual hosts on Shionogi's network.

This wiped out 88 virtualised servers that had contained most of Shionogi's US IT infrastructure, including its email and BlackBerry servers, its order-tracking system and financial management software.

FBI investigators tracked the attacker's IP address to a McDonald's restaurant in Smyrna, Georgia, where they also found that Cornish had made a $4.96 purchase using his debit card.

Cornish's quiet pre-installation of vSphere on the Shionogi server had also taken place from an identifiable location — Cornish's Atlanta home. He had also, from the same IP address, tried unsuccessfully to access various Shionogi user and admin accounts.

Shionogi said the attack had caused $300,000 (£180,000) in losses, due to the cost of responding to and assessing the damage, and restoring the networks to their former glory.