Warehouse hacker steals $95k of vouchers to 'mess with' employers

Troiden Timi Ngawaka Jamieson hacked into accounts of his employer, The Market, which the 25-year...
Troiden Timi Ngawaka Jamieson hacked into accounts of his employer, The Market, which the 25-year-old worked for in its Te Rapa, Hamilton, office. Photo: Getty Images
By Belinda Feek

A Hamilton man set about avenging “unfair treatment” and “messing with” his bosses at The Warehouse Group by hacking its computer system to steal $95,000 worth of vouchers in an elaborate and “complicated” computer fraud.

Troiden Timi Ngawaka Jamieson hacked into his supervisor’s account and a dormant administrative account belonging to the group’s subsidiary company, The Market, which the 25-year-old worked for in its Te Rapa, Hamilton, office.

He spent all but about $10,000 worth of the stolen coupons, or vouchers, in 121 separate orders of products being sold by The Market, including expensive electronic items.

While police were able to recover some of the items, at his home and the home of a family member’s former partner, a large amount were found in secondhand stores.

Jamieson appeared in the Hamilton District Court this week for sentencing on three charges, including one representative, of accessing a computer system for dishonest purposes.

‘Modifying Excel spreadsheets, hacking, 14 vouchers and $95,000′

Jamieson began working as a customer experience specialist for The Market in September 2021.

Given his role, he had access to the company’s shared computer network drives and online computing systems, as well as a Microsoft account.

He was given an employee administrative account that was to be used to assist with customers’ orders, shipping and returns, as well as helping retail stores with orders and organising gift card coupons and purchases.

For a voucher to be redeemed, a staff member accessed a pre-formatted Microsoft Excel spreadsheet, and then modified the data with the quantity of coupons, coupon codes, the dollar value per coupon, and the redemption period.

When the spreadsheet was finalised, the user saved the document as a copy.

When coupons were ready to be redeemed by a customer, a market employee with the required permissions imported the spreadsheet into the administrative control centre and emailed each customer the relevant coupon code.

‘The theft’

On the morning of December 10, 2022, Jamieson accessed The Market’s network system and modified the pre-formatted Excel spreadsheet for bulk gift card uploads, and created three separate spreadsheets.

He created four coupons worth $20,000 in his first modification, nine gift coupons worth $65,000 the second time, and one more worth $10,000.

Jamieson then hacked his supervisor’s account and uploaded the first modified spreadsheet to The Market online portal.

Those four coupons were redeemed during the December 2022-January 2023 period through a variety of stores through The Market website.

More than $17,000 worth of items, including expensive electronic devices, were bought.

Jamieson finished working for The Market on January 4, 2023, but his deceit continued.

Between 12.20am and 1.50am on Friday, January 6, he hacked into an old administration account that had lain dormant within The Market’s online administrative control centre.

He then uploaded the remaining two Excel spreadsheets into that account over the next week and redeemed the 10 coupons throughout that same month, placing 112 orders.

In total, 121 orders were made using Jamieson’s modified spreadsheets enabling him to obtain around $85,000 worth of items.

Those items were then couriered to his home or those of close associates.

While some property was recovered from his home, and the address of a family member’s former partner, a large amount was found in various second-hand stores.

In total he generated $95,000 worth of coupons, of which he redeemed $84,663.

‘It’s going to take a lifetime to repay’

Jamieson, who was supported in court by several family and friends, was keen to make amends, his counsel Charles Bean told Judge Stephen Clark.

However, when discussing the amount owed and how long it would take to repay, Judge Clark told him, “It’s going to take a lifetime”.

Jamieson - who has been working for the Ministry of Social Development for the past 17 months - had offered to pay $100 a week, as he was likely to keep his job if he got a sentence of home detention.

“It will take him 19 years to repay that at $100 a week,” the judge replied.

Police prosecutor Melanie Feist said The Warehouse Group [TWG] either wanted all of the reparation paid or none as its insurance policy stated that any money the company got repaid by the court would be the only money it kept.

The policy stated it would then revoke its full insurance cover for the stolen amount.

“Without that sum being [fully] reimbursed they will effectively be left out of pocket,” Feist said.

TWG also paid nearly $11,000 for a private investigator to look into the case, she said, so in total $95,419.33 was owed.

‘Wanted to mess with them’

Judge Clark described TWG’s loss as “quite significant”.

He said Jamieson was a heavy meth user at the time of the offending but found his comments around why he stole the vouchers as “troubling”.

Jamieson had set out to “avenge the unfair treatment that you had experienced and wanted to find a way to mess with them”.

“That’s an unusual explanation, Mr Jamieson.”

As for the reparation conundrum, Judge Clark said, “It does trouble me”.

While he understood TWG’s position, the Sentencing Act stated judges had to take into account the ability and means of a defendant to pay.

“I’m really reluctant to make an order that’s going to take 19 years.

“In the scheme of things, it’s more of a nominal order, around $10,000.

“The full sum is never, ever going to be repaid but you did end up causing significant damage to The Warehouse Group.”

After taking a start point of 33 months’ prison and applying 40% worth of discounts, Judge Clark sentenced Jamieson to 10 months’ home detention.

He also ordered he pay TWG $10,000 at $100 a week.