A Michigan man being held in the county jail was sentenced Friday in federal court to 84 months in prison for hacking UPMC's human resources computer systems and selling employees' identities on the dark web.

Justin Sean Johnson, 30, who pleaded guilty in May to charges of conspiracy and aggravated identity theft, appeared for sentencing through a video conference from Butler County Prison to the U.S. District Court in Pittsburgh before Chief Judge Mark R. Hornak.

Hornak sentenced Johnson to serve 60 months in prison for the conspiracy charge and 24 months consecutively for the identity theft charge. The sentence includes three years of probation for the conspiracy charge and one year of probation concurrently for the identity theft charge following his released from prison.

The remaining 41 charges filed against him by the U.S. attorney's office were dismissed in a plea agreement.

Johnson hacked the regional health system giant's computer system and sold personally identifiable information between 2014 and 2017, according to prosecutors.

After selling the information on dark web forums, buyers used the information to file more than a thousand fraudulent income tax returns with the IRS. The $1.7 million in refunds from those tax returns were used to buy Amazon gift cards that were used mostly to buy electronics that were shipped to Venezuela.

Johnson also sold other data online to dark web buyers during the same time frame.

According to prosecutors, Johnson used the pseudonym “The Dearth Star” and later “Dearthy Star” on dark web and other forums to sell the hacked personal information.

On one platform, Johnson advertised the identities and 2013 W-2 forms as including information primarily from Pennsylvania, and purchasers of the stolen identities “stated that TDS was a good seller, and said they would do business with him again,” according to Johnson's May 2020 indictment.

Buyers of the stolen data filed about 1,327 fraudulent tax returns using the information Johnson had sold resulting in the IRS issuing $1.7 million in fraudulent tax refunds, according to the indictment.

Johnson earned more than $8,200 in cryptocurrency in 2013 and 2014 due to those sales, according to prosecutors, and received at least another $1,850 in cryptocurrency for data sales in 2017.

Prosecutors said Johnson's actions affected more than 65,000 victims, leaving them open to years of potential financial fraud.