In a recent decision of the Ontario Court of Justice (the Court) in R. v Vachon-Desjardins, 2022 ONCJ 43, the Court sentenced the defendant to seven years in prison for his criminal activities involving ransomware attacks using malware in association with the NetWalker group and ordered restitution payments to victims of these ransomware attacks. This case is one of the first judgements of its kind in Canada.
In August 2020, the Royal Canadian Mounted Police (RCMP) received information from the American Federal Bureau of Investigation about a suspect operating in Gatineau, Quebec who was allegedly responsible for ransomware attacks in several countries, and suspected to have received over $15 million USD in ransom payments. Following an investigation, the suspect was identified as the defendant, Sebastien Vachon-Desjardins, and the RCMP seized 720 Bitcoins from his e-wallets and accounts (valued at approximately $34.5 million CAD at the time of sentencing).
The defendant cooperated with Canadian authorities, acknowledging that NetWalker was a cybergroup dedicated to creating data-theft-for-ransom software and attack strategies that shared its capabilities with cyber threat actors on a split-fee basis. Between May 2020 and January 2021, the defendant carried out cyberattacks against 17 Canadian entities and others around the world by breaching private computer networks and systems, hi-jacking data, holding the stolen data for ransom, and distributing the stolen data when ransoms were not paid.
The defendant pled guilty to five counts of offences involving mischief, theft of computer data, extortion, payment of cryptocurrency ransoms and participating in the activities of a criminal organization. In considering the appropriate sentence for these offences, the Court listed a number of aggravating factors, including:
The Court also noted the mitigating factors in the case, finding that the defendant’s guilty plea saved “untold investigative, prosecutorial, judicial, and court resources” and his cooperation helped identify victims and their losses.
The Court ordered restitution payments totalling around $2.8 million dollars to be paid to seven Canadian victims from the defendant’s assets seized by the RCMP.
Summary By: Anna Troshchynsky
Disclaimer: This Newsletter is intended to provide readers with general information on legal developments in the areas of e-commerce, information technology and intellectual property. It is not intended to be a complete statement of the law, nor is it intended to provide legal advice. No person should act or rely upon the information contained in this newsletter without seeking legal advice.
E-TIPS is a registered trade-mark of Deeth Williams Wall LLP.