Maryland Man Pleads Guilty to Cyber Intrusion Damaging Oregon's Medicaid Management System

PORTLAND, Ore.—Hossein Heydari, 61, of Gaithersburg, Maryland, pleaded guilty today to one count of fraud and related activity in connection with computers after intentionally damaging the Oregon Medicaid Management Information System (MMIS) and causing it to fail.

“Mr. Heydari’s illegal intrusion of the Oregon Medicaid system posed a serious risk to public health, jeopardizing patient medical exams, diagnoses and treatment,” said Billy J. Williams, U.S. Attorney for the District of Oregon. “If not properly secured, network insiders can pose a serious cyber threat to businesses and government agencies alike.”

“It is very important that the FBI and its partners work to deter future attacks by holding people such as Mr. Heydari responsible for their actions,” said Renn Cannon, Special Agent in Charge of the FBI in Oregon. “If any company or agency in the state suspects a system compromise, contact the FBI’s Oregon Cyber Task Force right away so that our experts can help to mitigate the damage and work to identify the intruder.”

According to court documents, Heydari was formerly employed by Hewlett Packard Enterprises (HPE) as a system administrator and technical support specialist. As part of an HPE contract with the Oregon Health Authority, Heydari had administrative access to Oregon MMIS servers located in Salem, Oregon. On October 28, 2016, Heydari was laid off by HPE. A few days later, he intentionally altered part of the MMIS system causing it to fail and resulting in an 8-hour loss of user functionality.

The Oregon MMIS is a marketplace for medical care providers, pharmacies and patients to exchange eligibility information for care, prescriptions and other benefits provided by Medicaid.

Heydari faces a maximum sentence of 10 years in prison, a $250,000 fine and three years of supervised release. He will be sentenced on August 12, 2019 before U.S. District Court Judge Michael H. Simon.

As part of the plea agreement, Heydari has agreed to pay $44,777 in restitution to the Oregon Health Authority and $31,195 to HPE.

This case was investigated by the FBI’s Oregon Cybercrime Task Force and is being prosecuted by Quinn P. Harrington, Assistant U.S. Attorney for the District of Oregon.

Any public or private entity suspecting a cyber intrusion or attack should contact the FBI through the Internet Crime Complaint Center at www.ic3.gov or by calling your nearest FBI office.