PITTSBURGH — A Michigan man accused of hacking UPMC's human resources database in 2014 and selling more than 65,000 employees' personal data was arrested in Detroit on federal charges Tuesday.

Justin Sean Johnson faces 47 counts, including conspiracy to defraud the United States, wire fraud and aggravated identity theft, in connection with the 2014 hack and sale of personally identifiable information and W-2 tax forms, which U.S. Attorney Scott Brady said were used to file thousands of false income tax returns.

According to the federal prosecutor, Johnson sold the personal information on dark web forums, where buyers would use the information to file fraudulent tax forms with the IRS. Brady added that the tax refunds stemming from the filings, about $1.7 million in total, were used to buy Amazon gift cards in turn used to buy products shipped to Venezuela.

“Justin Johnson stands accused of stealing the names, Social Security numbers, addresses and salary information of every employee of Pennsylvania's largest health care system,” Brady said in a Thursday statement. “His theft left over 65,000 victims vulnerable to years of potential financial fraud.”

An indictment by a federal grand jury handed down May 20 accuses Johnson of selling other data to dark web buyers between 2014 to 2017.

Tom Fatturosso, special agent in charge of the IRS' criminal investigations division, said victims of identity fraud often face years of fallout.

“Unfortunately, through no fault of their own, the people whose identities are stolen in cases like this are often victimized repeatedly,” he said.

If convicted, Johnson could face up to five years in prison on each conspiracy count, up to 20 years in prison for each wire fraud charge and a minimum of 24 months in prison on each count of aggravated identity theft, in addition to fines.