The term "Breaking Bad" means to "turn toward immorality or crime". It was popularized by the TV show by the same name in 2008. In the show, a high school teacher desperate for money turns to making and selling meth.

This section of errata documents cases where information security professionals were convicted of criminal activity, often the very computer crime they purported to defend and protect clients from. In each case these pages merely document news articles written by journalists from reputable media outlets. The attrition.org staff are not making any commentary, simply documenting these cases for reference.

In cases where someone was arrested, convicted, served time, and subsequently released, we sincerely hope that they have found a new path forward. We would like to believe that the criminal justice and penal systems offer that path to rehabilitation but also know that doesn't always work out. No judgement is being made after release. Despite that process these pages will remain up to document what happened. Future employers deserve to know if their employees have a criminal past, especially if they re-enter the information security industry.

	Angelo_Martino	Former ransomware negotiator plead guilty to collaborating with ranswomare operator criminals to extort companies for money. [More information.]
	Bryan Fleming	Creator of pcTattletale, a "stalkerware" application, plead guilty to charges in violation of Title 18, USC, Sections 2512(1)(b). [More information.]
	John "Jack" Burkman	Creator several fake intelligence companies, claims of buying vulnerabilities for governments, and a long history of convictions and plea deals for fraud and more. [More information.]
	Jacob Wohl	Creator several fake intelligence companies, claims of buying vulnerabilities for governments, and a long history of convictions and plea deals for fraud and more. [More information.]
	Jeffrey Bowie	Charged and plead no contest to felony violation of the Oklahoma Computer Crimes Act. [More information.]
	Joseph Sullivan	Charged, found guilty, appealed, and upheld on conviction of obstruction of proceedings of the FTC and misprision of felony in connection with his attempted cover-up of a 2016 hack of Uber. [More information.]
	Kevin Tyler Martin	Indicted and serving prison sentence over collusion with ransomware criminals to conduct attacks while working as a ransomware negotiator. [More information.]
	Ryan Clifford Goldberg	Indicted and serving prison sentence over collusion with ransomware criminals to conduct attacks while working as a ransomware negotiator. [More information.]
	Peter Joseph Williams	Former L3 / Trenchent executive plead guilty to two counts of theft of trade secrets after selling zero-day vulnerabilities to a Russian broker. [More information.]
	Jack B. Blount	Former CEO of Intrusion Inc. was sued by the SEC for false and misleading statements about both their products and his career experience. [More information.]
	Shakeeb Ahmend	Former security engineer at Amazon hacked two cryptocurrency echanges, stealing over $12 million in funds. [More information.]
	Scott Zuckerman	CEO of SpyFone.com, he was banned from doing business by the FTC due to the flagship product acting as spyware. Attempts to overturn the ban were unsuccessful. [More information.]
	Max Butler	Max Ray Butler ("Iceman") went from FBI informant/hacker to running the CardersMarket cybercrime forum, stealing 1.8M credit card numbers, and then got caught smuggling contraband by drone from prison. [More information.]
	James N. Johns Jr.	Johns, owner of Retina-X Studios, sold "stalkerware" apps that let purchasers secretly track another person's phone. The company failed to secure stolen data from the apps, accessed in databreaches in 2017 and 2018. The FTC settled with Johns in October 2019, its first-ever case against a stalkerware developer. [More information.]
	Justin Liverman	Justin Liverman (D3F4ULT) used social engineering to hack the personal accounts of the CIA director, DNI, and other senior officials, then dumped tens of thousands of FBI/DHS employees' data -- earning him 5 years in prison. [More information.]
	Andrew Otto Boggs	Andrew "INCURSIO" Boggs, part of Crackas With Attitude, broke into law enforcement databases and exposed personal data on ~20,000 people -- sentenced to 2 years in June 2017. [More information.]
	Sam Bent	Sam Bent ran a dark web drug operation out of Vermont, sentenced to five years prison, became a paralegal and effected an 18-month sentence reduction, then rebranded as an OSINT/OPSEC "darknet expert" on YouTube and the conference circuit. [More information.]
	Pepijn van der Stap	Pepijn van der Stap ("Umbreon") led a double life as a cybersecurity engineer by day and data-extortion hacker by night, got 4 years for it in 2023 -- then went straight as an offensive security lead, only to be re-arrested in the ShinyHunters/FBI-hack investigation and charged with soliciting two murders. [More information.]
	Zohar Pinhasi	Zohar Pinhasi ran MonsterCloud as a “no ransom payment” decryption service, then allegedly just paid the hackers himself and pocketed the markup -- charging clients $19M+ while secretly sending $8M+ to the attackers, netting roughly $11M. [More information.]
	Edward Dubrovsky	Ed Dubrovsky, a Canadian cybersecurity executive at ransomware-negotiation firms CYPFER and CyberSteward, was arrested on federal extortion charges. He’s possibly tied to ShinyHunters’ breach of the FBI’s jobs portal, though that’s unconfirmed. [More information.]
	Brett Shannon Johnson	Brett Shannon Johnson, a ShadowCrew administrator, turned Secret Service informant after his 2005 arrest but kept committing fraud (stolen-card purchases, bogus tax returns) while working undercover for the agency. Prior to ceasing criminal activity, he was a self-claimed "Cyber Crime Consultant" [More information.]

Copyright by Attrition.org. Permission is granted to quote, reprint or redistribute provided the text is not altered, and appropriate credit is given. Original graphic concept by Jay Dyson, modified by Google Gemini for this page.