A former Michigan man being housed in Butler County Prison admitted in federal court Thursday to hacking UPMC's human resources systems and selling employees' identities on the dark web.

Justin Sean Johnson pleaded guilty to one count each of conspiracy to defraud the United States and wire fraud in connection with a plea deal offered him by federal prosecutors, and will face up to seven years in federal prison.

Johnson's plea comes in connection with the hacking and sale of personally identifiable information between 2014 and 2017, which prosecutors alleged were used to file thousands of false income tax returns.

According to prosecutors, Johnson sold the personal information on dark web forums, where buyers used the information to file fraudulent tax returns with the IRS. Tax refunds stemming from the filings, totalling about $1.7 million, were used to buy Amazon gift cards, which were in turn used to purchase products — primarily electronics — shipped to Venezuela. Between 2014 and 2017, Johnson also sold other data online to dark web buyers.

Utilizing dark web forums and other platforms, according to prosecutors, Johnson utilized the pseudonym “The Dearth Star” and later “Dearthy Star” to facilitate the sale of the hacked personal information to others. On one platform, a 2020 indictment stated, Johnson advertised the identities and 2013 W-2 forms as including information primarily from Pennsylvania, and purchasers of the stolen identities “stated that TDS was a good seller, and said they would do business with him again.”

From January 2014 to March 2014, prosecutors alleged, buyers of the stolen data filed approximately 1,327 false tax returns utilizing the information Johnson had sold. Those returns, the indictment stated, resulted in the IRS issuing $1.7 million in fraudulent tax refunds.

Johnson earned more than $8,200 in cryptocurrency in 2013 and 2014 due to those sales, according to prosecutors, and received at least another $1,850 in cryptocurrency for data sales in 2017.

Prosecutors alleged Johnson's tactics affected more than 65,000 victims, leaving them open to years of financial fraud now and into the future.

Part of Johnson's plea agreement includes him admitting his responsibility for the conduct with which the United States charged him in 39 counts withdrawn as part of the deal.

In sum, Johnson faces up to five years in prison for the conspiracy charge and a mandatory minimum of two years on wire fraud, the sentences of which will be served consecutively. Under government sentencing guidelines, Johnson will likely be imprisoned for about four years on the conspiracy charge.

He also faces fines of not more than $250,000 on each count as well as supervised release following his prison term and mandatory restitution to the victims.