Man pleads guilty to hacking VA health records system

A Tennessee man is facing prison time for hacking into a Department of Veterans Affairs health platform, accessing a Marine Corps veteran’s personal health information, and posting it on an Instagram feed he named “@hackedthegovernment,” federal officials said.

Nicholas Moore, 24, pleaded guilty Jan. 16 in federal court to hacking the VA-run My HealtheVet site, Department of Justice officials announced this week. Veterans use the platform to manage their personal health records like prescribed medications, send “secure messages to communicate privately” with their health providers, schedule appointments, and order medical supplies.

According to the DOJ, Moore was able to access the VA health platform for five days in late 2023 by using stolen login credentials of a Marine Corps veteran, which court documents identified as “HW.” Prosecutors did not indicate whether the former Marine was aware of Moore’s hacking, nor did they explain how Moore accessed the veteran’s login credentials

Moore sent screenshots of the veteran’s personal health information, which included his medication prescriptions, to “an associate” on Oct. 13, 2023, according to court filings. On Oct. 15, he posted screenshots to the @hackedthegovernment account, “boasting of his access to the VA’s servers and to HW’s personal information,” officials said in court documents. The screenshots included the veteran’s full name, address, service, email, phone number, and blood type.

The account was not publicly accessible on Instagram this week.

The details of Moore’s hacking were included in a plea agreement signed by Moore and entered into the D.C. district federal court on Jan. 16. An inquiry sent to Moore’s lawyer was not immediately returned.

My HealtheVet is “operated on computer servers located in various jurisdictions in the United States. These servers are used in and affected interstate commerce and communication,” according to the DOJ. In October 2023, the VA announced that it was moving its My HealtheVet to the VA.gov website, putting all VA benefits and services in one place, rather than on separate platforms.

“VA takes veterans’ privacy seriously. We continuously evaluate systems security and regularly implement measures to strengthen protections of veterans’ personal information. VA has been in contact with the veteran in this case,” VA press secretary Pete Kasperowicz told Task & Purpose in a statement.

Moore also pleaded guilty to using stolen credentials to hack into the U.S. Supreme Court’s electronic filing system for nearly a month and MyAmeriCorps servers in 2023. In both incidents, he also posted screenshots of the user’s name and information on his @ihackedthegovernment Instagram.

Moore pleaded guilty to one count of fraud activity in connection with computers, which carries a possible one-year prison sentence and a fine of up to $100,000. He was released from custody, according to court filings. His sentencing hearing is set for April, DOJ officials said in the release.