A former database administrator for GEXA Energy has been convicted following his guilty plea to intruding into his former employer’s computer database system. The conviction of Steven Jinwoo Kim, 40, was announced yesterday by United States Attorney Tim Johnson.
At a hearing before U.S. District Judge Vanessa Gilmore, Kim admitted to recklessly causing damage to a GEXA Energy protected computer. GEXA Energy is a retail electric utility provider based in Houston.
On Feb. 5, 2008, GEXA Energy terminated Kim’s employment as a database administrator and permanently revoked his access to all GEXA Energy facilities, computer networks and information technology systems. Approximately three months later, Kim remotely accessed the GEXA Energy computer network and the GEXA Energy Management System (GEMS) database. While connected to the GEXA Energy computer network, Kim recklessly caused damage by, among other things, issuing various Oracle database commands which created a new data table in the GEMS production database which, when copied to the GEMS staging database, caused the automated script to fail thus impairing the availability of data.
As a result of the Kim’s intrusion into their protected computer system, GEXA Energy incurred a loss of at least $100,000, the costs associated with troubleshooting, securing and repairing the GEXA Energy computer network and the GEMS database. Kim was indicted in June 2009.
GEXA customers were not notified of the breach until April 2009. In letters sent to those affected, the utility provider indicated that it had been prohibited from telling them of the incident sooner because of the investigation.
Judge Gilmore has set Kim’s sentencing for March 1, 2010, at 9:30 a.m. He faces a maximum punishment of five years imprisonment and/or a $250,000 fine for his actions. Kim has been permitted to remain on bond pending his sentencing.