Daniel Soares

Profile narrative

The threat actor known publicly as Daniel Soares, also referred to by his alias Daniel Soares, is a resident of Commack, New York, in the United States of America. He came to attention in mid‑2015 after being identified as one of three students who tampered with the computer system of Commack High School. Soares was 17 years old at the time of the incident and was described as a participant in the school’s computer science club. His actions led to criminal charges of burglary and computer tampering.

The actor’s activity was confined to the education sector, specifically targeting a single high school located on Long Island. The primary objective demonstrated in the incident was to modify academic records, including raising his own grades in physics, economics and history and altering the grades of a peer. In addition, he changed the class schedules of hundreds of students, which constituted a disruption of normal school operations. No evidence indicates that the actor pursued financial gain, espionage, or any broader ideological motive.

The technique employed involved the physical placement of a hardware keylogger on a classroom computer keyboard, a device that records every keystroke made on the machine. After leaving the device in place for several days, Soares retrieved it and used the captured keystroke logs to obtain usernames and passwords for the school’s network. With those credentials he gained unauthorized access to the district’s data management system, where he proceeded to alter grades and schedules. No malware families or custom software tools were referenced in the reporting; the operation relied solely on the keylogger and the stolen credentials.

Attribution to any state sponsor, criminal consortium, or organized hacking group has not been established in the open sources; the actor appears to have acted as an individual student with assistance from two classmates. The 2015 Commack High School incident remains the only publicly reported operation linked to Daniel Soares, serving as a representative example of his activity. Following the breach, school officials corrected the altered data, reinforced password protections, and prevented further unauthorized access. Soares, along with his accomplices, faced legal proceedings and was released on his own recognizance after arraignment.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.