Episode
01 November 2018 Official episode · Official transcript
bug hunter research
The episode concerns Alberto Hill, a Uruguayan security professional convicted after a medical provider was hacked and patient records were used in an extortion attempt. It discusses the investigation, seized security equipment, digital-forensics failures, and the uncertainty surrounding Alberto’s conviction.
Topics: Default credentials and weak authentication, Web application compromise, Database and patient-record access, Data exfiltration, Ransomware-style Bitcoin extortion, Vulnerability disclosure to a national CERT, Digital forensics and evidence handling, Hard-drive imaging and evidence preservation, USB attack and destructive testing devices, Security testing hardware, Hardware cryptocurrency wallets, Credit-card chip and PIN security, Malware in security research labs, VPNs and proxy use, Legal treatment of security researchers, Attribution based on IP addresses, Cybersecurity professional and hacker culture
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
medical-provider patient-record extortion COMPROMISES medical provider
The incident involved an attacker breaking into the medical provider's website, accessing its database, and taking patient records.
Explicit Confidence 99% · Jack Rhysider EP 25 Details
“The hacker broke in through the provider’s website, accessed the database and took a ton of patient records.”
medical-provider patient-record extortion INITIAL_ACCESS_VIA website compromise
The attacker initially gained access through the medical provider's website.
Explicit Confidence 99% · Jack Rhysider EP 25 Details
“The hacker broke in through the provider’s website”
medical-provider patient-record extortion INVOLVES Data exfiltration
The attacker accessed the database and took patient records.
Explicit Confidence 99% · Jack Rhysider EP 25 Details
“accessed the database and took a ton of patient records”
medical-provider patient-record extortion INVOLVES extortion
The attacker demanded Bitcoin and threatened to release confidential patient information, including details about people with HIV and cancer.
Explicit Confidence 99% · Jack Rhysider EP 25 Details
“sent a ransom e-mail to the medical providers showing they had confidential data and demanded they pay fifteen Bitcoin”
Operation Bitcoins SAME_AS medical-provider patient-record extortion
Jack says the police called the medical-provider extortion case Operation Bitcoins.
Explicit Confidence 96% · Jack Rhysider EP 25 Details
“They contacted the police who called this case Operation Bitcoins.”
medical-provider patient-record extortion ATTRIBUTED_TO Alberto Hill
Uruguayan police and the courts attributed the medical-provider hack and extortion to Alberto, but Alberto repeatedly denied doing it and Jack questions whether the wrong person was convicted.
Attributed Confidence 93% · Jack Rhysider EP 25 Details
“Alberto was found guilty and he was being sent to a long-term prison”
“I did not do it. I didn’t do it and I am innocent.”
“which is probably why in the end they caught the wrong guy”
admin/admin default credentials DISCOVERED_BY Alberto Hill
Alberto discovered that the medical provider's website accepted admin/admin as administrator credentials.
Explicit Confidence 99% · Jack Rhysider EP 25 Details
“Just for fun he tried to log in as the username admin with the password admin and it worked.”
Alberto Hill EXPLOITS admin/admin default credentials
Alberto used the admin/admin default credentials to access the medical facility's systems while investigating and reporting the vulnerability.
Explicit Confidence 98% · Alberto Hill EP 25 Details
“I mean, admin/admin, and I had access to all the systems”
Alberto Hill ASSOCIATED_WITH CERT of Uruguay
Alberto reported the discovered medical-provider vulnerability to the Uruguayan CERT, which confirmed that the problem existed.
Explicit Confidence 99% · Alberto Hill EP 25 Details
“I immediately sent an e-mail to the CERT of Uruguay.”
“In two hours they replied to me and they say okay, [00:10:00] it is confirmed.”
Alberto Hill MEMBER_OF Interpol
Jack says Alberto previously worked with Interpol conducting digital forensics.
Explicit Confidence 90% · Jack Rhysider EP 25 Details
“Before that Alberto was working with Interpol doing digital forensics.”
Alberto Hill USES VPN
After his release, Alberto says he used a VPN when finding security problems and chose not to report them.
Explicit Confidence 99% · Alberto Hill EP 25 Details
“Of course I was connecting with a VPN and a proxy”
Alberto Hill USES proxy
After his release, Alberto says he used a proxy when finding security problems and chose not to report them.
Explicit Confidence 99% · Alberto Hill EP 25 Details
“Of course I was connecting with a VPN and a proxy”
Jack Rhysider AUTHORED Darknet Diaries
Jack identifies himself as the creator of Darknet Diaries.
Explicit Confidence 98% · Jack Rhysider EP 25 Details
“This show is created by me, La Sombra, Jack Rhysider”
La Sombra AUTHORED Darknet Diaries
The outro credits La Sombra as one of the creators of Darknet Diaries.
Explicit Confidence 98% · Jack Rhysider EP 25 Details
“This show is created by me, La Sombra, Jack Rhysider”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T05:12:26.517283+00:00