Canadian ransomware hacker sentenced to 20 years in U.S. prison

A former Canadian government employee turned ransomware hacker has been sentenced to a 20-year prison term in the United States in what a federal court judge called "the worst case he's ever seen."

Visibly outraged, Justice William F. Jung described Sébastien Vachon-Desjardins of Gatineau, Que., as "Jesse James meets the 21st century," referring to the notorious 19th century American outlaw as he handed down his decision in Tampa, Fla., on Tuesday.

In June, Vachon-Desjardins — a former IT specialist for Public Services and Procurement Canada — pleaded guilty to four charges, including computer fraud and transmitting a demand in relation to damaging a protected computer in the U.S.

Vachon-Desjardins, 35, was one of the most prolific affiliates of Netwalker, a Russian-speaking ransomware criminal gang that operated at the height of the COVID-19 pandemic.

The group of affiliates hacked into computer systems of health districts, companies and schools, and demanded ransom payments in exchange for returning the encrypted data. If demands were not met, their data would be posted on the Netwalker blog hosted on the dark web.

Netwalker targeted as many as 400 victims in more than 30 countries and collected $40 million in ransom payments, according to U.S. attorney Carlton Gammons, who called the victimization "staggering." He said one third of ransoms paid out were in relation to attacks Vachon-Desjardins was part of.

'I would have given you life,' says judge

Gammons said the pre-sentencing report didn't reveal anything remarkable to suggest weighing in favour of a lesser sentence. He said Vachon-Desjardins had good parents, was educated, had no mental issues or drug use, and was not under any financial stress.

"If you had gone to trial, I would have given you life," said Jung, who handed Vachon-Desjardins 240 months in prison — a longer sentence than the prosecution was asking for. 

Wearing an orange jumpsuit and glasses, with a buzzcut and appearing downcast, Vachon-Desjardins listened silently to the judge explain his decision.

Jung said two key factors guided him: a desire to deter others from committing similar crimes, and Vachon-Desjardins' "horrible behaviour."

Mark O'Brien, lawyer for the defence, attempted to make a case for a lighter sentence earlier in the proceeding, referring to his client's decision to forfeit a trial and plead guilty, his remorse for his crimes and restitution to victims. 

He described Vachon-Desjardins as polite, cooperative and as one of his favourite clients in all his years of practice.  

Case settled in Canada

Following his arrest in January 2021 in Gatineau, RCMP searched Vachon-Desjardins' home and recovered a value of $28 million US in bitcoin at the time and seized $500,000 in cash.

He pleaded guilty in a Brampton, Ont., courtroom one year later to committing ransomware crimes against 17 Canadian companies, organizations, schools and a municipality. For those crimes, he received a seven-year sentence. 

In May 2021, he was extradited to the United States to face the charges against him in Tampa.

Vachon-Desjardins has agreed to forfeit the money he gained as proceeds of his crimes. He chose not to provide any information on his co-conspirators.

He will return to federal court in January for a hearing to determine restitution payments for victims.

The case of Sébastien Vachon-Desjardins is the focus of an upcoming The Fifth Estate documentary, airing later this fall on CBC-TV and CBC Gem.