Miscalculated, but where? A hacker hacked into companies without hiding his data and offered to hire him

In the USA, a man frequented businesses, including a gym where he worked out, hacked computers, and then offered to be hired. The outcome was somewhat predictable.

Nicholas Michael Kloster, from Kansas City, Missouri, aged 31, has been charged with two counts: unauthorized access to a protected computer and obtaining information, as well as causing damage through recklessness to a protected computer during unauthorized access. The way he did it resembles the clumsy movies of the 1980s and memes about “hackers.”

In one instance, Kloster entered a business premises that manages several health clubs. The next day, he sent an email to one of the owners offering his services along with his resume. He claimed to have accessed the company’s computer system and stated that he had “helped over 30 small and medium industrial enterprises.”

After the intrusion, the company’s employees noticed that his monthly gym membership fee had been “reduced” to $1, and his photo was erased from the company’s network. A few weeks later, the hacker posted a screenshot of his desktop with the security camera management interface on social media with the caption “How to make a company use your security service.”

In another case, Kloster visited a non-profit organization, entered a restricted area, and accessed its computer and network. The hacker used a boot disk, “which allowed him to gain access to the company’s computer using several user accounts.” Afterward, he managed to change a user password and set up a VPN. Following Kloster’s intrusion, the company allegedly suffered losses of over $5,000, which were spent on remedying the intrusion.

In yet another victim company where the hacker was employed, he used the company’s credit card to make numerous personal purchases, including a flash device advertised as a tool for hacking vulnerable computers (apparently, this is how the “career” of the hacker started).

The listed actions are charges that the court has yet to prove. The mentioned cases occurred in the spring of 2024. It remains to be seen how Nicholas Michael Kloster intended to care about someone’s security, without being able to simply think about his own. Nevertheless, the victim companies’ computer networks could still use some expert assistance.

Source: US Attorney’s Office