Lifelock
Attribution profile
- Type
- Hacker
- Location
- United States of America
- Known incidents
- 1 incident
- Sources
- 1 source
- First seen
- 2016-06-26
- Last seen
- 2016-06-26
- Updated
- 2026-10-11 05:17
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Actor known as Todd Davis, also using alias Lifelock, is based in the United States. He has targeted healthcare organizations in Michigan, seeking financial gain through extortion and the sale of stolen patient data. His reported initial access involved compromising an RDP server, after which the victim disabled RDP access upon noticing his contact. No specific malware families or tooling are described in the source material. He has no publicly attributed state affiliation or criminal consortium linkage. A notable operation is the June 2016 breach of Holland Eye Surgery & Laser Center, where he demanded a $10,000 “security fee,” subsequently sold portions of the stolen data on dark‑web markets such as AlphaBay and TradeRoute, and repeatedly pressured the victim over nearly two years before the incident was disclosed.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 1 source.