“I hacked your company,” says a message on the CEO’s monitor. “You should hire me to protect you.” It seems like something out of a 90s Hollywood movie (or a self-aware 2010s YouTube short). But a Missouri man allegedly tried to make it a reality by “hacking” multiple businesses and selling his security services to them. He got arrested instead.
According to the US Attorney’s Office in Kansas City, Missouri, Nicholas Michael Kloster has been formally charged with accessing a protected computer and related offenses. The press release (spotted by BleepingComputer) compiles investigation from the FBI and the Kansas City Police Department. It alleges that Kloster “entered the premises” of a health club, accessed its computers, then emailed the owner and asked to be hired for his “security service.”
A few weeks later, Kloster posted on social media (the exact one isn’t mentioned) with a screenshot of himself remotely controlling the club’s security cameras. “How to get a company to use your computer service” read the post, according to the US Attorney’s Office. He also allegedly reduced his own membership fee to $1 per month, erased his photo from the club’s database, and stole a staff nametag.
Kloster’s other alleged crimes are a little less Hollywood. The District Attorney accuses him of also breaking into a “nonprofit corporation,” again by physically going to the building, entering an area that isn’t accessible to the public, then loading up a boot disk. He allegedly reset user passwords and installed a VPN, causing the corporation more than $5,000 in damages.
He also (again, allegedly!) used his employer’s company credit card to shop for himself. His purchases, which would have been easily tracked by both his bosses and investigators, included “a thumb drive that was advertised as a means to hack into vulnerable computers.”
I am not a hacker. But if I were, physically breaking into a gym where I apparently went on a regular basis wouldn’t be my first dastardly deed. Or my second, following fraudulent purchases of something advertised as a hacking tool paid for with my boss’s credit card.