Graham Ivan Clark

Graham Ivan Clark grew up in Hillsborough County, Florida with his mother, father and older sister.[1] His parents divorced when he was 7; his father now lives in Indiana.[2]

During his teenager years, Clark would go under various aliases whilst participating in online communities, gaining notoriety as a scammer in the "hardcore factions" Minecraft community.

In 2018, Graham would join the forum OGUsers (now branded as OGU) and after 4 days would be banned from the forum.

In 2019, at the age of 16, Clark would be involved in stealing 164 bitcoins from Gregg Bennett, a Seattle-based angel investor, through a SIM swap attack. Clark would send two extortion notes under the alias "Scrim", stating “We just want the remainder of the funds in the Bittrex", referring to the cryptocurrency exchange "Bittrex" that Bennett had used, and “We are always one step ahead and this is your easiest option.". The United States Secret Service would manage to recover only 100 bitcoins from the heist.[3] In an interview the victim, Gregg Bennett, was told by a Secret Service agent that the person with the stolen Bitcoins was not arrested because he was a minor.[2]

Clark is widely regarded as the "mastermind" of the 2020 Twitter account hijacking,[4][5] an event in which Clark along with Mason Sheppard, 19 at the time, and Nima Fazeli, 22 at the time would work together in compromising 130 high-profile Twitter accounts to push a cryptocurrency scam involving bitcoin along with seizing "OG" (short for original gangster) usernames to sell on OGUsers (a forum dedicated to selling, buying and trading accounts gained through legal or illegal means), the latter done first in the timeline of the account hijacking. Sheppard and Fazeli would specialise in playing the role of brokers in selling the Twitter handles on OGUsers.

The Twitter hack began on 14 June when Sheppard and Fazeli would assist Clark in manipulating employees through social engineering.[6] This involved calling up multiple Twitter employees, posing as the help desk in Twitter’s IT department, under the cover of responding to a reported problem an employee was having with Twitter’s internal Virtual Private Network. From here, Clark directed the employee to a phishing site, identical in appearance to Twitter's internal Virtual Private Network login portal and as credentials were being entered into the phishing portal, the employee's credentials were simultaneously entered into the real page. After compromising one account of a Twitter employee, the account was used to review Twitter's intranet websites on accessing the internal tools used to take over Twitter accounts.[7]

On 31 July 2020, Graham was arrested at his home in Northdale. He faced 30 criminal charges against him: 17 counts of communication fraud, 11 counts of fraudulent use of personal information, 1 count of organized fraud for more than $5,000, and 1 count of accessing a computer or electronic device without authority. He pleaded not guilty to all charges. Clark had a bail of $725,000.

Clark had his court hearing on 16 March 2021 via Zoom at Hillsborough County Jail. He was sentenced to 3 years in prison followed by 3 years of probation as part of a plea deal; he was sentenced under Florida’s Youthful Offender Act, which limits the penalties on convicted felons under the age of 21.[8] According to the Tampa Bay Times, he would be able to "to serve some of his time in a military-style boot camp".[9]

As part of his plea agreement,[10] Graham would agree to have "no direct or indirect access" to electronic devices without the permission of those supervising his probation and by notifying the Florida Department of Law Enforcement. He is to also provide both groups "a list of any and all electronic mail addresses, Interactive computer services, Internet domain names, commercial social networking websites, online or remote storage and computing devices, Internet identifiers and each Internet identifier's corresponding website [sic] homepage or application software name; home telephone numbers and cellular telephone numbers in his care custody or control.". In addition, Graham would have to hand over to the two groups any "Technological access barrier", defined as "a password, security code, token, key fob, access device, or similar measure."[11]

Clark was released from Saint Petersburg Community Release Center on 16 February 2023.[12]