Federal prosecutors in Western Washington secured a grand jury indictment on Thursday against a Swiss national accused by the U.S. of hacking dozens of companies and government agencies.
Tillie Kottman, a 21-year-old hacker, has reportedly taken credit for intrusions at major U.S. companies like Nissan and Intel, according to Bloomberg, which broke news of a breach at a California-based security camera company last week; another hack that Kottmann has reportedly claimed.
U.S. attorneys allege that Kottmann, in concert with others online, acquired stolen credentials and accessed protected systems to steal confidential records and code. The stolen data was hosted on a private website that’s been seized by the FBI, as well as on Telegram and other services, charging papers say.
Prosecutors say notable targets included a security device company, a tactical equipment maker, an automobile manufacturer, and a financial investment firm.
A website run by the hackers is at one point said to have held data from over 100 companies, including Adobe, Toyota, Pepsi, Microsoft, AMD, Motorola, GE Appliances, Disney, Nintendo, and more.
Cyber-intel news site The Record reports that Kottmann relied on misconfiguration to gain access to protected data and linked them to an FBI industry alert in October warning of hackers capitalizing on default password settings in corporate and government software.
The FBI said it’s working closely with Swiss authorities, which executed a search of Kottmann’s apartment last week in Lucerne, Switzerland, reportedly seizing electronic devices.
The raid followed reports of a security breach at Verkada, a Silicon Valley security camera startup, which Bloomberg reported Kottmann has taken credit for. The search of Kottmann’s home was reported to be part of a separate investigation at the time.
The U.S. investigation of Tillmann, who uses they/them pronouns, is being aided by police officials in Luzerne and the Swiss Federal Office of Justice, officials said.
“Stealing credentials and data, and publishing source code and proprietary and sensitive information on the web is not protected speech–it is theft and fraud,” Acting U.S. Attorney Tessa M. Gorman said in a statement. “These actions can increase vulnerabilities for everyone from large corporations to individual consumers.”
“Wrapping oneself in an allegedly altruistic motive does not remove the criminal stench from such intrusion, theft, and fraud,” she added.
Prosecutors say Kottmann—whom Bloomberg describes as having an “anti-intellectual property ideology”—is only one member of a collective behind the hacks.
In the case of Verkada, the group was able to gain access to the live feeds of some 150,000 surveillance cameras inside prisons, schools, police departments, and more.
Kottmann is represented by Marcel Bosonnet, who acted as Edward Snowden’s attorney in Switzerland.