Colbi Trent Defiore

Profile narrative

Colbi Trent Defiore is identified as a United States-based individual threat actor whose publicly reported activity centers on insider misuse of access to a health-care enrollment environment. No additional aliases are provided in the available material. Defiore was described as a seasonal worker for an unnamed Virginia-based technology company that supported the Centers for Medicare & Medicaid Services by operating contact centers for Medicare enrollment and related processes. The available reporting does not establish membership in a criminal consortium, state sponsorship, or any broader organized group.

The only described targeting involves Healthcare.gov customer personally identifiable information accessed through a CMS-supported contact center in Bogalusa, Louisiana. Defiore conducted unauthorized bulk searches of the Healthcare.gov database, even though such searches were prohibited, and accessed data belonging to more than 8,000 individuals. The stated objective was personal financial gain: the stolen information was used to apply for credit cards, personal loans, and lines of credit. At least five consumers’ information was used for at least six such accounts or credit products. The reporting characterizes the impact as financial rather than espionage or disruption, with affected call-center operators incurring $587,000 in response, remediation, victim-contact, and theft-protection costs.

The notable tradecraft described is low-complexity insider data theft rather than malware-based intrusion. Defiore copied bulk search results to a clipboard, emailed the results to his work email account, and later accessed that account remotely without authorization after the workday ended. He had received training on proper handling of consumer PII, but admitted to accessing and obtaining consumer data on multiple occasions. In November 2019, a federal grand jury charged him with intentionally accessing a protected computer in excess of authorization for commercial advantage and private financial gain, and in furtherance of a felony. He was sentenced to 42 months in prison, received three years of supervised release, and was ordered to pay a $100 special assessment fee. No malware families, exploit kits, command-and-control infrastructure, or named hacking tools are referenced in the source material.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.