Photo courtesy of Google StreetView
Scientist created 4,100 fraudulent health reward accounts making up fake spouses for coworkers, reports said
A five-year-long case of fraud reported from Merck Global Security Group (GSG) was recently solved, police said, when the accused willingly assisted police in accessing incriminating files.
According to a criminal complaint, a first incident was discovered by Merck and a third-party company named Virgin Pulse (VP) on Sept. 19, 2019, when the West Point site director in MRL Engineering, Sarath Moses, was victimized. Police said that the fraud encompassed $49,000 in total and all occurred along at an office on the 500 block of Louise Lane in Upper Gwynedd Township, where 4,100 fraudulent Merck employee accounts were set up with VP accounts.
Merck partnered with VP in order to provide “LiveIt” program rewards for employees who completed positive health activities. VP sends rewards via email accounts in the form of gift cards. Police allege that, cards were sent to short-term email addresses and redeemed as an actor used the names of 4,100 legitimate Merck employees, and then sent out an additional 4,100 invites to their “fake spouses.” Police reported that accounts only required a Merck WIN number (a work ID number) and an employee’s last name to activate, which they say the unknown actor began utilizing in 2019.
At that time, police said, Merck discovered the source IP address to a Comcast customer and reviewed six months of VPN traffic for a potential match of an inside user to that IP address. Police said that the account was connected to Onur Yoruk, 38, of the 100 block of Bickley Road, Glenside. At that time, police reports state, Yoruk was employed as an associate principal scientist with Merck and worked at the “Idea Center” on Louise Lane.
Yoruk reported directly to Moses and “interfaced with data analytics to support various drug line investigations,” according to reports.
GSG conducted an interview with Yoruk on March 5, 2020 when he was told the interview was to determine if “he was responsible for the breach of the VP gift card rebate program,” according to police. At that time, Yoruk admitted that he did “breach the system and received gift cards for signing Merck employees and their spouses up for the program,” said the report.
Police said Yoruk obtained WIN numbers by defeating the Inspire database with a program he developed. He reported that he’d made around $49,000 by doing so, reports stated. Yoruk conducted this fraud on a Merck-issued Apple MacBook laptop computer, putting the compromised 4,100 approximate Merck employee accounts that were hacked into a unique spreadsheet file, said police.
Complaints noted that Yoruk created a second program that took the WIN numbers and names and automatically signed them up for gift card programs with VP. This file, police said, was also suspected to be on the same laptop, but the file’s name was unknown.
Once the employee set up the programs, he was able to obtain gift card data, which he claimed was stored on a personal computer at his apartment, reports said, adding that a Dropbox and a Gmail account in his name was also used. The Merck-issued laptop was turned over to Merck employees on March 5, 2020, and then to police on March 9, 2020, when it was entered into evidence.
On Jan. 11, 2024, Yoruk and his attorney, Richard Fushino, came to the station to assist police in finding files on the laptop, police said. Though police had obtained a search warrant for the MacBook Pro, signed by Judge Suzan Leonard, Yoruk was “free to leave or stop assisting” at any time, according to police.
After Yoruck provided his password and log-in, he showed police the location of the files on his computer, said the report. A warrant was then issued for Yoruck’s arrest. Yoruck faces five felony counts including theft by unlawful taking of a movable property, receiving stolen property, unlawful use of a computer with access to disrupt function, unlawful duplication, and computer trespassing via transfer of funds.
Yoruck is scheduled to have a preliminary hearing on Sept. 19 at 11 a.m. before Magisterial District Judge Suzan Leonard.
Police said the five-year delay in an arrest was due to a few issues: Covid, the number of victims involved, and the defendant taking a long time to comply with the investigation. An arrest was made within the statute of limitations, police said.
All suspects and defendants are innocent until proven guilty. This story was compiled using public court records.
