BENGALURU: Former Delhi-based IT consultant Deepanshu Kher was sentenced to two years in prison for accessing the server of California-based Carlsbad Company and deleting over 1,200 of its 1,500 Microsoft user accounts. A US judge also sentenced Kher to three years’ supervised release and asked him to repay Carlsbad $567,084 — the amount that it paid to fix the problems that Kher had caused.
The 32-year-old IT professional was employed by a tech consulting firm while he was deputed at Carlsbad to assist with its migration to Microsoft Office 365 from 2017 through May 2018.
The consulting firm was not named in the court order.
Carlsbad was dissatisfied with Kher’s work, and the consulting firm he was working for pulled him from the company’s headquarters. In August 2018, two months after he returned to India, Kher hacked into Carlsbad’s server and deleted the user accounts.
A press release from the US Attorney’s office said the deletion meant employees could not access their email, their contacts lists, their meeting calendars, their documents, corporate directories, video & audio conferences, and virtual teams’ environment necessary for them to perform their jobs.
The judge noted that Kher perpetrated a significant and sophisticated attack — planned and clearly intended as revenge. Kher was arrested when he flew from India to the US on January 11, unaware of the outstanding warrant for his arrest. The FBI was able to identify, arrest, and prosecute Kher despite the fact that he committed the hack while outside the US.
Prior to his arrest, in December 2019, the US government had moved a US court requesting travel technology firm Sabre to provide FBI complete real-time account activity information of Kher on a weekly basis for six months. The purpose was to know if Kher was travelling to the US.