Former Ubiquiti developer Nickolas Sharp has been sentenced to six years in prison for the data hack and the related theft from his former employer.

In late 2020, Nickolas Sharp stole dozens of gigabytes of data from his own employer, tech company Ubiquiti. He tried to pay himself an extra New Year’s bounty and extorted nearly $2 million from the company. He was sentenced to six years in prison by a New York court.

The facts

At the time of his action, Sharp was a lead developer at Ubiquiti. This gave him access to data that the company processes via Amazon Web Services and GitHub. He used this to steal gigabytes of data from his employer. First, he posed as an anonymous hacker and extorted $1.9 million from Ubiquiti. However, the company refused and Sharp put part of the data online.

Ubiquiti went to the FBI and then things happened pretty quickly. Sharp always used a VPN to disguise his unauthorized logins to the company’s systems, but during one of those sessions, due to a very brief online outage, he hadn’t realized that his IP address had been registered at home. That quickly got the Feds on track during the investigation, though Sharp manipulated data to make it appear that unwitting colleagues were behind the hack. His claim that he would never be foolish enough to reveal his own IP address and that he had been betrayed did not immediately gain widespread support.

With full awareness, Nickolas Sharp began protecting himself, erasing all data from the laptop he used for the hacks and then completely resetting the device. Turns out Sharp wasn’t the sharpest of pencils though, as he just had the laptop at home. The device was therefore seized by the FBI during a search of his home, barely two months after Sharp’s blackmail attempt.

The Hunchback of Ubiquiti

Then the story got a little stranger. In a daring attempt to go down a completely different path, Sharp takes on the role of whistleblower and reaches out to the media; Not only does he claim that Ubiquiti is vulnerable, but also that the company wanted to cover up the hack. It also made the hack look a lot worse than it actually was. Those claims caused his employer’s market value to drop by as much as $4 billion at the time.

Crime doesn’t pay

It was all in vain. At the end of 2021, the curtain fell and Nickolas Sharp was arrested. The list of allegations included not only hacker attacks and data theft, but also knowingly compromising secure devices, (financial) fraud via telecommunications or the Internet, and lying by the FBI.

During his trial, Sharp made a final attempt to convince the court that his actions were in fact a security test he himself conducted because his CEO prevented him from fixing certain digital vulnerabilities. This desperate attempt was of little use and Sharp was sentenced to six years in prison. This is well below the possible 35 to 37 years and even below the eight to ten years required by the lawyer; whom Sharp described as a persistent liar and data thief.