Alleged Hacker Flaunted Wealth -- WSJ

Karim Baratov was known as an avid car enthusiast

By David George-Cosh 

The man who seems most likely to face prosecution in the Yahoo Inc. data breach is a 22-year-old Canadian resident who bragged online about dropping out of high school to pursue an internet career that apparently enabled him to live luxuriously.

Karim Baratov, a dual Canadian-Kazakh national, was arrested outside Toronto on Tuesday by police for his alleged role carrying out hacking assignments for Russian spies and his own personal financial gain. The indictment alleges Mr. Baratov gained access to Yahoo and Google email accounts and received payment of about $100 for each password.

According to Mr. Baratov's friends, he lived in a two-story house located in a tony suburb outside Hamilton, Ontario, and was known as an avid car enthusiast with an active social-media presence.

Mr. Baratov flaunted his apparent wealth on his Facebook and Instagram accounts, showing off exotic cars with vanity license plates, expensive Rolex watches and top-shelf cigars.

In one post on his Facebook profile, he bragged about getting suspended from high school in 2013 "for threatening to kill my ex-friend as a joke." He wrote that he used the time off to set up his own business, which helped him make enough money to purchase a BMW and buy a house, before getting expelled from school. "Everything happens for a reason, and this really changed my life to better!" he wrote.

Several of his Instagram photos show him flexing his biceps with various tattoos, including one in binary that translates to "Mr Karim," which also appears on the license plates of several cars including a baby-blue Lamborghini.

The luxury items in the photos couldn't be verified as his own, but U.S. authorities said Mr. Baratov owns at least two luxury cars, an Aston Martin convertible with the license plate "Mr. Karim," and a black Mercedes-Benz sedan, both of which are to be forfeited to the U.S. if he is convicted.

In a picture taken during a meeting of so-called supercar enthusiasts which he linked to from his Instagram account, Mr. Baratov was photographed sitting in his Aston Martin. "This car is comfortable. It's beautiful. It's fast. It's a good balance between comfort and speed," he told a reporter for The Globe and Mail last August.

Mr. Baratov often told friends he built websites for Russian online users. He managed one website similar to Netflix that he said has about 30,000 subscribers that pay about 17 Canadian dollars (US$12.61) a month, according to Dillon Kovljenic, who runs an automotive decal company near Toronto and recently did some work on Mr. Baratov's cars.

Mr. Kovljenic said Mr. Baratov told him that he immigrated to Canada from Russia when he was 13 years old and no longer lives with his parents.

"He looks like the most innocent guy in the world," Mr. Kovljenic said.

Vadim Polonski, who runs a Toronto-based telecommunications company, said he frequently encountered Mr. Baratov at various charity events organized by exotic car enthusiasts over the past several years. "He's a super nice guy," he said. "I never really knew what he did [for a living] but I always wondered because it seemed that he was doing really well."

Migena Skenderaj, a friend of Mr. Baratov who occasionally cut his hair, said she was surprised to see that he drew a portrait of her which he later posted on his Instagram account. Mr. Baratov occasionally posted images of his drawings, which includes luxury cars, a scene from the movie Titanic, bags filled with cash and several abstract self-portraits.

An attempt to reach Mr. Baratov for comment was unsuccessful, and a Canadian government official didn't know if Mr. Baratov already had retained legal counsel.

Mr. Baratov is due to appear in a Canadian court for a bail hearing later this week and will face extradition to the U.S., officials said. The other three men indicted by U.S. authorities are believed to be at large in Russia, and the two countries don't have an extradition treaty.

U.S. authorities charged Mr. Baratov with conspiring to commit access device fraud, conspiring to commit wire fraud, aggravated identity theft and conspiring to commit computer fraud and abuse. The charges carry sentences ranging from two to 20 years in prison.

U.S. officials said Mr. Baratov also went by the names Kay, Karim Taloverov and Karim Akehmet Tokbergenov.

Write to David George-Cosh at [e-mail]

(END) Dow Jones Newswires

March 16, 2017 02:47 ET (06:47 GMT)

Copyright (c) 2017 Dow Jones & Company, Inc.