Marcel Lehel Lazăr (born(1971-11-23)November 23, 1971), known asGuccifer, is aRomanianhacker responsible for high-levelcomputer security breaches in the U.S. and Romania. Lazăr targeted celebrities, Romanian andU.S. government officials, and other prominent persons.[1]
Lazăr first appeared in news media in February 2013 after the websiteThe Smoking Gun reported he was responsible for hacking theAOL account ofDorothy Bush Koch, sister of former presidentGeorge W. Bush.[2] Family photos of former presidentGeorge H. W. Bush, who was in the hospital at the time, were circulated to the internet. He also circulated a self-portraitpainted by George W. Bush. Lazăr went on to hack a number ofAOL,Yahoo!,Flickr, andFacebook accounts, giving him access to information about current and former high-level government officials.
In January 2014, Lazăr was jailed in his native Romania for seven years after being convicted of hacking emails of Romanian officials. Lazăr was subsequently extradited by Romania to the United States, where he was indicted onfederal charges. In May 2016, Lazărpleaded guilty infederal court to two charges. In September 2016, he was sentenced to 52 months in prison in the United States.[3][4] Romanian authorities asked for Lazăr to be released to his home nation to complete his seven-year prison sentence there before being returned to the U.S. to serve his federal prison sentence.[3]
Lazăr is of Romanian andHungarian ancestry.[5] He lived in the village of Sâmbăteni, part of thePăuliș commune, to the east ofArad, Romania.[5]
Lazăr has said that hispseudonym Guccifer is aportmanteau of "Gucci" and "Lucifer" (a reference, he says, to "the style of Gucci and the light of Lucifer").[6]
Lazăr had no particular computer expertise, but instead used patience and persistence to obtain private information.[5] Lazăr had "no fancy equipment, only a clunky NEC desktop and a Samsung cellphone, and no special skills beyond what he had picked up on the web."[5] He used the simple technique of finding information about his victims online and then using this to guess the correct answers tosecurity questions.[5] At the time of his arrest in 2014, Lazăr was an unemployed taxi driver.[5]
Lazăr later hackedColin Powell's website and accessed years' worth of his correspondence from another AOL account. The correspondence included personal financial information as well as e-mails toGeorge Tenet,Richard Armitage, andJohn Negroponte.[7] Through six months of trial and error, Lazărguessed the password of Romanian politicianCorina Crețu and gained access to her correspondence with Powell.[5]
The hacker also targeted U.S. SenatorLisa Murkowski; a senior UN official; members of theRockefeller family; former FBI and Secret Serviceagents,[8] as well as the brother ofBarbara Bush, CBS sportscasterJim Nantz, and formerMiss Maine Patricia Legere.[9]
On March 20, 2013,USA Today reported that Lazăr had successfully hacked the e-mail account ofSidney Blumenthal, a former aide to former presidentBill Clinton.[10] He distributed private memos from Blumenthal to Secretary of StateHillary Clinton involvingrecent events in Libya, including the September 11, 2012 Benghazi attack.[11] Before distributing the memos, he copied and pasted the text into his own new documents, then reformatted them with pink backgrounds andComic Sans font.[11] The hacker's IP address was traced toRussia, however there was no certainty as to whether this was his actual location or whether he had used a proxy to hide his true location.[12]
In early May 2013, Lazăr hacked into online accounts owned by two members of theCouncil on Foreign Relations, as well as accounts owned byAdam Posen and his wife and another owned by a formerFederal Reserve Board official.[13]
TSG reported on May 7, 2013, that Lazăr had hacked theTwitter feed and e-mail account ofSex and the City authorCandace Bushnell.[13] Bushnell spent several hours fighting for control of the accounts, while Lazăr publicly posted portions of an unpublished manuscript to Bushnell's Twitter feed. Lazăr sent an e-mail to TSG claiming responsibility for the hack using the AOL account of actorRupert Everett.[13]
On 22 January 2014, Lazăr, then age 40, was arrested by the Romanian law enforcement agency DIICOT (the Department of Investigation of Organized Crime and Terrorism Offenses,Direcția de Investigare a Infracțiunilor de Criminalitate Organizată și Terorism) at his home in Sâmbăteni,Arad County.[14][15]
In 2014, a Romanian court sentenced Lazăr to four years in jail for accessing email accounts of public figures "with the aim of getting ... confidential data."[16]
Lazăr already had a police record in Romania, having been arrested and convicted there in 2011 for "hacking into the email accounts of Romanian starlets and other celebrities" under the pseudonymMicul Fum ("Little Smoke").[5] He was serving a separate three-year sentence in Romania for those crimes.[16]
In an interview with theNew York Times in November 2014 conducted while Lazăr was imprisoned in the Arad Penitentiary, the hacker "read out a lengthy handwritten statement that he said explained the purpose of his hacking," which included "a potpourri ofconspiracy theories about the terrorist attacks of September 11, 2001, the 1997 death of Princess Diana and alleged plans for a nuclear attack in Chicago in 2015."[5] Lazăr claimed that the world is run by theIlluminati and a cabal of others.[5]
On June 12, 2014, Lazăr was indicted by afederal grand jury in theUnited States District Court for the Eastern District of Virginia inAlexandria, Virginia, on nine charges: three counts ofwire fraud, three counts of gaining unauthorized access to protected computers, and one count each of aggravatedidentity theft,cyberstalking andobstruction of justice.[16][17][18]
The indictment alleged that:
From December 2012 to January 2014, [Lazăr] hacked into the email and social media accounts of high-profile victims, including a family member of two former U.S. presidents, a former U.S. Cabinet member, a former member of the U.S.Joint Chiefs of Staff and a former presidential advisor. After gaining unauthorized access to their email and social media accounts, [Lazăr] publicly released his victims' private email correspondence, medical and financial information, and personal photographs. The indictment also alleges that in July and August 2013, [Lazăr] impersonated a victim after compromising the victim's account.[18]
In March 2016, Romania approved an 18-month temporary extradition to the United States, and Lazăr was surrendered to U.S. authorities.[16][17] Since his extradition, Lazăr has been detained atAlexandria City Jail[19][20] inAlexandria, Virginia.[12] He made his first U.S. court appearance on April 1, 2016.[21]
In May 2016—one month after being extradited to the U.S., and while jailed in Virginia awaiting trial—Guccifer claimed to have repeatedly hackedHillary Clinton's email server. This claim occurred in the midst of anongoing FBI probe of Clinton's use of a private email server while serving asUnited States Secretary of State. Lazăr claimed that the server was "like an open orchid on the Internet"[22] and that "it was easy ... easy for me, for everybody."[12]
Lazăr provided no proof of his claim, and U.S. investigators found no evidence to support the claim.[23][24][25] U.S. officials have also said that if Lazăr had obtained information from Clinton's servers, he would have publicly released such information, as he did when he obtained access to other high-profile individuals,[25] such asSidney Blumenthal[26] andGeorge W. Bush.[27] According to an FBI report, Lazăr stated during interrogation that he had lied toFOX News when claiming he hacked Clinton's e-mail server, and investigators determined that although he may have attempted to access the server, no additional solid forensic evidence was found to tie Lazăr to this failed access attempt.[28]
On May 25, 2016, Lazăr—then age 44—pleaded guilty in U.S. federal court to unauthorized access to a protected computer and aggravated identity theft as part of a plea agreement with federal prosecutors.[29]
According to a Justice Department press release:
In a statement of facts filed with his plea agreement, [Lazăr] admitted that from at least October 2012 to January 2014, he intentionally gained unauthorized access to personal email and social media accounts belonging to approximately 100 Americans, and he did so to unlawfully obtain his victims' personal information and email correspondence. His victims included an immediate family member of two former U.S. presidents, a former member of the U.S. Cabinet, a former member of the U.S. Joint Chiefs of Staff and a former presidential advisor, he admitted. [Lazăr] admitted that in many instances, he publically [sic] released his victims’ private email correspondence, medical and financial information and personal photographs.[29]
On September 1, 2016, U.S. District JudgeJames C. Cacheris sentenced Lazăr to 52 months in prison. The judge also stated that theJustice Ministry of Romania had made a request for Lazăr to be returned to Romania to complete his prison service there, before being conditionally released in 2018 and returned to America to serve his U.S. prison sentence.[3] He was released from prison in August 2021.[30]
Lazar said he chose to use 'proxy servers in Russia,' describing them as the best, providing anonymity. Cyber experts who spoke with Fox News said the process Lazar described is plausible. The federal indictment Lazar faces in the U.S. for cyber-crimes specifically alleges he used "a proxy server located in Russia" for the Blumenthal compromise.
[T]he hacker provided no proof of his claim to have hacked Clinton's server.
[Lazăr] refused to show any of the material he said he found on the Clinton server, and federal investigators said they have found no evidence to back up his claim.
U.S. officials also dismissed claims by a Romanian hacker now facing federal charges in Virginia that he was able to breach Clinton's personal email server. The officials said investigators have found no evidence to support the assertion by Marcel Lehel Lazar to Fox News and others, and they believed if he had accessed Clinton's emails, he would have released them — as he did when he got into accounts of other high-profile people.