Ex-Canadian government worker pleads guilty to U.S. ransomware charges

A former Canadian federal public servant from Gatineau, Que., who pleaded guilty in Canada after a ransomware investigation that netted tens of millions of dollars' worth of seized bitcoin has now pleaded guilty to similar charges in the United States.

Sébastien Vachon-Desjardins was arrested by RCMP in January last year on allegations he was a key figure in an international ransomware ring known as NetWalker.

NetWalker is alleged to have targeted businesses and other institutions by encrypting data on their systems, and then holding that data for ransom. It's also alleged it accessed and stole sensitive personal information about employees, clients and users.

After the RCMP arrest, Vachon-Desjardins was charged with mischief in relation to computer data, unauthorized use of a computer, extortion and participating in a criminal organization.

In January this year, he pleaded guilty via video in a Brampton, Ont., courtroom to all but the unauthorized use of a computer charge, and was sentenced to seven years in prison.

The RCMP and Department of Justice said in March that Vachon-Desjardins faced similar charges in Florida and he was extradited that month.

In Florida court documents dated May 23, Vachon-Desjardins pleaded guilty to four charges. The government recommends he get a lesser penalty when he is sentenced.

Vachon-Desjardins agreed to forfeit about $21.5 million US remaining from proceeds of these crimes, along with 27.65 bitcoins, and co-operate with other investigations.

As part of the agreement, he agrees he "was one of the most prolific NetWalker Ransomware affiliates."

FBI contacted RCMP in 2020

The RCMP's investigation into Vachon-Desjardins began in August 2020 when the FBI asked for help to identify a Canadian suspect in its NetWalker investigation.

Those Florida court documents show Vachon-Desjardins infiltrated an unnamed company in Tampa on April 30, 2020.

That company, referred to as Victim 1 in the documents, spent about $1.2 million US to get back to normal instead of paying the $300,000 US demanded in a note Vachon-Desjardins sent.

Evidence the FBI gave to the RCMP allowed it to start its own probe into whether crimes had been committed in Canada. 

• International cybercops derail botnet used to extort, steal data around the globe
• Ex Canadian government worker extradited to U.S.

RCMP and Gatineau police searched the Gatineau home of Vachon-Desjardins in January 2021 and seized computing and storage devices, 719 bitcoins (worth tens of millions of dollars) and $790,000 Cdn.

The cryptocurrency seizure was believed to be the largest in Canada to date in terms of monetary value, the RCMP said then.

Public Services and Procurement Canada wrote in an email this past March that Vachon-Desjardins hadn't been employed at the department since Jan. 13, but declined to answer other questions about his employment history.