Ex Canadian government worker extradited to U.S. to face more ransomware charges

A former federal public servant from Gatineau, Que., who recently pleaded guilty after a joint FBI-RCMP ransomware investigation that netted tens of millions of dollars' worth of seized bitcoin, has now been extradited to the U.S. to face similar charges.

Sébastien Vachon-Desjardins, 34, was arrested by RCMP in January last year on allegations he was a key figure in an international ransomware ring known as NetWalker.

NetWalker is alleged to have targeted businesses and other institutions by encrypting data on their systems, and then holding that data for ransom. It's also alleged it accessed and stole sensitive personal information about employees, clients and users.

"NetWalker ransomware has targeted dozens of victims all over the world, including companies, municipalities, hospitals, law enforcement, emergency services, school districts, colleges, and universities," the Department of Justice said in a news release Thursday about the extradition of Vachon-Desjardins.

"Attacks have specifically targeted the health-care sector during the COVID-19 pandemic, taking advantage of the global crisis to extort victims."

After the RCMP arrest, Vachon-Desjardins was charged with mischief in relation to computer data, unauthorized use of a computer, extortion and participating in a criminal organization.

In January this year, he pleaded guilty via video in a Brampton, Ont., courtroom to all but the unauthorized use of a computer charge, and was sentenced to seven years in prison.

The RCMP and Department of Justice said Thursday that Vachon-Desjardins faces similar charges in Florida, and was extradited Wednesday as the FBI's case begins winding through court.

Public Services and Procurement Canada wrote in an email Friday that Vachon-Desjardins hasn't been employed at the department since Jan. 13, but declined to answer other questions about his employment history.

17 Canadian companies targeted by convict

The RCMP's investigation into Vachon-Desjardins began in August 2020 when the FBI asked for help to identify a Canadian suspect in its NetWalker investigation. Evidence the FBI gave to the RCMP allowed it to start its own probe into whether crimes had been committed in Canada. 

RCMP and Gatineau police searched the Gatineau home of Vachon-Desjardins in January 2021 and seized computing and storage devices, 719 bitcoin (worth tens of millions of dollars) and $790,000 Cdn.

The cryptocurrency seizure is believed to be the largest in Canada to date in terms of monetary value, the RCMP said Thursday.

Prior to his guilty plea, court had heard that information on a Polish server identified Vachon-Desjardins as one of the most profitable affiliates of the NetWalker group.

More than 20 terabytes of data were retrieved from his seized devices, and an RCMP analysis identified 17 Canadian companies that had been targeted by Vachon-Desjardins.

After the guilty plea, he was ordered to forfeit 680 of the 719 bitcoin originally seized. As of Thursday morning, those 680 bitcoin are worth more than $34 million Cdn.

The judge also ordered more than $2.6 million Cdn in restitution for businesses affected.

Vachon-Desjardins was scheduled to make his first appearance in a U.S. court on Thursday.