WASHINGTON—Federal prosecutors have charged a man in Malaysia with hacking the personal information of more than 1,000 U.S. military personnel and federal employees and giving that information to Islamic State terror group.
The suspect, a citizen of Kosovo named Ardit Ferizi, was detained in Malaysia based on a U.S. arrest warrant, officials said.
Officials say Mr. Ferizi called himself “Th3Dir3ctorY’’ online, and is the leader of a Kosovar Internet hacking group called Kosova Hacker’s Security. Prosecutors say he hacked into a corporate computer system in the U.S., stole data about Americans who worked for the government, including military personnel, and then gave it to Islamic State member Junaid Hussain, a hacker working for the group who was killed by an airstrike in August.
Assistant Attorney General John Carlin, who heads the Justice Department’s National Security Division, said the charges amounted to a first-of-its-kind case in which a hacker teamed up with a terror group to target Americans for violence.
“Ardit Ferizi is a terrorist hacker who provided material support to ISIL by stealing the personally identifiable information of U.S. service members and federal employees and providing it to ISIL for use against those employees,’’ said Mr. Carlin, using an alternate name for the group.
Authorities expect Mr. Ferizi to be extradited to the U.S., where he is likely to face trial for providing material support to Islamic State, unauthorized access to a computer, and aggravated identity theft.
It wasn't immediately clear if Mr. Ferizi had a lawyer.
Malaysia’s police chief, Khalid Abu Bakar, said in a statement Thursday that the 20-year-old suspect arrived in Malaysia in August to study computer science and computer forensics at a local college. Mr. Khalid said Mr. Ferizi is now being held to await extradition to the U.S.
Islamic State has urged supporters to conduct individual attacks on U.S. military personnel at their homes or wherever they can find them.
According to a criminal complaint unsealed Thursday in federal court in Northern Virginia, Mr. Ferizi around June targeted a server used by an unidentified U.S. retailer and stole the information relating to roughly 100,000 customers. Mr. Ferizi apparently culled from that information the details of 1,351 U.S. military service members and federal employees, according to the Federal Bureau of Investigation.
He provided that information to Mr. Hussain, the complaint alleges, and Mr. Hussain then used Twitter to post a link on Aug. 11 to a 30-page document listing those Americans.
At the top of the document was a threat reading, “We are in your emails and computer systems, watching and recording your every move, we have your names and addresses, we are in your emails and social media accounts, we are extracting confidential data and passing on your personal information to the soldiers of the Khilafah, who soon with the permission of Allah will strike at your necks in your own lands!’’ The Khalifah is a term for the leader of the Caliphate.
The case offers a vivid example of the sometimes far-flung global nature of terrorism: A 20-year-old Kosovar citizen living in Malaysia on a student visa allegedly sharing stolen data with a British hacker living in Syria to encourage and facilitate attacks in America.