IN THE UNITED STATES DISTRICT COURT FOR THE

WESTERN DISTRICT OF MISSOURI

WESTERN DIVISION

UNITED STATES OF AMERICA, Case No. 24-00275-01-CR-W-DGK

Plaintiff, COUNT ONE:

(Accessing a Protected Computer and
v. Obtaining Information)
18 U.S.C. §§ 1030(a)(2) and (c)(2)(B)(i)
NICHOLAS MICHAEL KLOSTER, NMT: Five Years’ Imprisonment
[DOB: 07/03/1994] NMT: $250,000 Fine
NMT: Three Years’ Supervised Release
Defendant. Class D Felony

COUNT TWO:
(Reckless Damage to a Protected Computer
During Unauthorized Access)
18 U.S.C. §§ 1030(a)(5)(B) and (c)(4)(A)(i)(I)
NMT: Five Years’ Imprisonment
NMT: $250,000 Fine
NMT: Three Years’ Supervised Release
Class D Felony

ALLEGATION OF FORFEITURE
18 U.S.C. § 982(a)(2)(B) and 18 U.S.C.
§ 1030(i)

$100 Special Assessment Per Each Count

Restitution May Be Ordered

INDICTMENT

THE GRAND JURY CHARGES THAT:

1. At all material times:

2. The defendant, NICHOLAS MICHAEL KLOSTER (“KLOSTER”), resided in

Kansas City, Missouri, which is within the Western District of Missouri.

3. COMPANY VICTIM 1 is a general business, for-profit corporation based in

Kansas City, Missouri, which is within the Western District of Missouri.

Case 4:24-cr-00275-DGK Document 1 Filed 11/19/24 Page 1 of 6

 4. COMPANY VICTIM 2 is a for-profit company that operates multiple health

clubs in Kansas and Missouri, including multiple locations within the Western District of

Missouri. COMPANY VICTIM 2, formed as a legal or other entity under Missouri law, is

considered a “person” as that term is defined in 18 U.S.C. § 1030(e)(12).

5. COMPANY VICTIM 3 is a nonprofit corporation formed under the laws of the

State of Missouri, and is based in Kansas City, Missouri, which is within the Western District of

Missouri. COMPANY VICTIM 3, formed as a corporation under Missouri law, is considered a

“person” as that term is defined in 18 U.S.C. § 1030(e)(12).

KLOSTER Seeks Employment with COMPANY VICTIM 1

6. In or about March 2024, KLOSTER was hired by COMPANY VICTIM 1.

7. While employed at COMPANY VICTIM 1, KLOSTER used a company credit

card to make numerous personal purchases, including a thumb drive which was advertised as a

means to hack into vulnerable computers.

8. COMPANY VICTIM 1 fired KLOSTER on or about April 30, 2024, and

demanded that he return to the company various stolen items.

KLOSTER’s Intrusion Into Computer Owned by COMPANY VICTIM 2

9. Beginning on or about April 26, 2024, KLOSTER entered the premises of

COMPANY VICTIM 2 shortly before midnight.

10. The following day, April 27, 2024, KLOSTER sent an email to one of the owners

of COMPANY VICTIM 2 – from his work email address at COMPANY VICTIM 1 – writing,

“I managed to circumvent the login for the security cameras by using their visible

IP addresses … I also gained access to the GoogleFiber Router settings, which allowed me to use

[redacted] to explore user accounts associated with the domain … If I can reach the files on a

user’s computer, it indicates potential for deeper system access.” KLOSTER claimed in this
2

Case 4:24-cr-00275-DGK Document 1 Filed 11/19/24 Page 2 of 6

email to have “assisted over 30 small to medium-sized industrial businesses in the Kansas City,

Missouri area” and also attached a copy of what he described as his resume, which greatly

differed from what he had previously provided to COMPANY VICTIM 1.

11. Following KLOSTER’s intrusion, employees with COMPANY VICTIM 2 noted

that KLOSTER’s monthly gym membership fee was reduced to $1, that his photograph was

erased from the gym’s network, and determined that KLOSTER stole a gym staff nametag.

12. A few weeks later, KLOSTER posted an image to a social media profile which

appeared to be a screen capture of his desktop showing control of the security cameras for

COMPANY VICTIM 2, with a chatbox window with the message “how to get a company to use

your security service.”

13. The computer accessed by KLOSTER at COMPANY VICTIM 2 was a

“protected computer” as defined in 18 U.S.C. § 1030(e)(2)(B), as it was a computer that was

used in or affecting interstate or foreign commerce or communication.

KLOSTER’s Intrusion Into Computer Owned by COMPANY VICTIM 3

14. On or about May 20, 2024, KLOSTER entered the premises of COMPANY

VICTIM 3. KLOSTER entered an area owned and maintained by COMPANY VICTIM 3 that is

not available to the general public and accessed a computer. This computer is owned by

COMPANY VICTIM 3, has access to COMPANY VICTIM 3’s network, and, on May 20, 2024,

had access to the Internet at the time of KLOSTER’s intrusion.

15. On or about that date, KLOSTER utilized a boot disk, which enabled him to

access COMPANY VICTIM 3’s computer through multiple user accounts. By accessing

COMPANY VICTIM 3’s computer in such a manner, the use of this boot disk enabled

KLOSTER to circumvent the password requirements on COMPANY VICTIM 3’s computer and

change the password assigned to one or more of the users of COMPANY VICTIM 3’s computer.
3

Case 4:24-cr-00275-DGK Document 1 Filed 11/19/24 Page 3 of 6

With this gained access to COMPANY VICTIM 3’s computer and network, KLOSTER was able

to, and did, install a virtual private network on this computer.

16. Since KLOSTER’s intrusion into its computer and its network, COMPANY

VICTIM 3 has sustained losses in excess of $5,000 in an attempt to remediate the effects

from this intrusion.

17. The computer accessed by KLOSTER at COMPANY VICTIM 3 was a

“protected computer” as defined in 18 U.S.C. § 1030(e)(2)(B), as it was a computer that was

used in or affecting interstate or foreign commerce or communication.

COUNT ONE
Accessing COMPANY VICTIM 2’s Protected Computer and Obtaining Information
(18 U.S.C. §§ 1030(a)(2) and (c)(2)(B)(i))

18. On or about April 26, 2024, in the Western District of Missouri and elsewhere,

the defendant, NICHOLAS MICHAEL KLOSTER, intentionally accessed a computer owned by

COMPANY VICTIM 2 without authorization, and thereby obtained information from a

protected computer, and the offense was committed for purposes of commercial advantage and

private financial gain, all in violation of Title 18, United States Code, Sections 1030(a)(2)

and (c)(2)(B)(i).

COUNT TWO
Reckless Damage to COMPANY VICTIM 3’s Protected Computer
During Unauthorized Access
(18 U.S.C. § 1030(a)(5)(B))

19. Between on or about May 20 and May 21, 2024, in the Western District of

Missouri and elsewhere, the defendant, NICHOLAS MICHAEL KLOSTER, intentionally

accessed a protected computer owned by COMPANY VICTIM 3 without authorization, and as a

result of such conduct recklessly caused damage, and the offense caused loss to one person, that

is, the nonprofit corporation COMPANY VICTIM 3 during a 1-year period from KLOSTER’s

Case 4:24-cr-00275-DGK Document 1 Filed 11/19/24 Page 4 of 6

course of conduct affecting a protected computer aggregating at least $5,000 in value, all in

violation of Title 18, United States Code, Sections 1030(a)(5)(B) and (c)(4)(A)(i)(I).

FORFEITURE ALLEGATION

20. The allegations contained in Counts One and Two are hereby realleged and

incorporated by reference for the purpose of alleging forfeiture pursuant to Title 18, United

States Code, Section 982(a)(2)(B) and Title 18, United States Code, Section 1030(i). Upon

conviction of the offenses alleged in Counts One and Two of this Indictment, and pursuant

to Title 18, United States Code, Section 982(a)(2)(B) and Title 18, United States Code,

Section 1030(i), the defendant shall forfeit to the United States all property, real and personal,

constituting and derived from any proceeds the defendant obtained directly and indirectly as a

result of the violations incorporated by reference in this allegation; any personal property that

was used or intended to be used to commit or to facilitate the commission of such violations; and

any property, real or personal, constituting or derived from, any proceeds that such person

obtained, directly or indirectly, as a result of such violations.

21. The property subject to forfeiture includes, but is not limited to, a forfeiture

money judgment representing the proceeds obtained by the defendant, in that such sum, in

aggregate, is involved in, or derived from, proceeds traceable to the offenses set forth in Counts

One and Two of this Indictment.

Substitute Assets

22. If any of the property described above as being subject to forfeiture, as a result of

any act or omission of the defendant:

a. cannot be located upon the exercise of due diligence;

b. has been transferred or sold to, or deposited with, a third party;

c. has been placed beyond the jurisdiction of the Court;

5

Case 4:24-cr-00275-DGK Document 1 Filed 11/19/24 Page 5 of 6

 d. has been substantially diminished in value; or

e. has been commingled with other property which cannot be divided

without difficulty;

it is the intent of the United States of America, pursuant to Title 21, United States Code,

Section 853(p), as incorporated by Title 18, United States Code, Section 982(b), to seek

forfeiture of any other property of the defendant up to the value of the above-forfeitable property

or to seek return of the property to the jurisdiction of the Court so that the property may be

seized and forfeited.

A TRUE BILL.

SIGNATURE ON FILE WITH USAO

FOREPERSON OF THE GRAND JURY

/s/Patrick Daly
Patrick Daly
Assistant United States Attorney

Dated: November 19, 2024

Kansas City, Missouri

Case 4:24-cr-00275-DGK Document 1 Filed 11/19/24 Page 6 of 6

 UNITED STATES DISTRICT COURT
WESTERN DISTRICT OF MISSOURI

CRIMINAL CASE COVER SHEET

Division of Filing Place of Offense Matter to be Sealed
Western St. Joseph Secret Indictment
Central Southern Jackson Juvenile
County and
Southwestern
elsewhere
Defendant Information
Defendant Name Nicholas Michael Kloster
Alias Name
Birthdate 07/03/1994

Related Case Information

Superseding Indictment/Information Yes No if yes, original case number
New Defendant Yes No
Prior Complaint Case Number, if any
Prior Target Letter Case Number, if any

U.S. Attorney Information

AUSA Patrick Daly

Interpreter Needed
Yes Language and/or dialect
No

Location Status
Arrest Date
Currently in Federal Custody
Currently in State Custody Writ Required Yes No
Currently on Bond Warrant Required Yes No

U.S.C. Citations
Total # of Counts 2

Set Index Key/Code/Offense Level Description of Offense Charged Count(s)

Accessing a Computer and Obtaining
1 18.1030A.F/4996/4 1
Information
Reckless Damage to a Protected
2 18.1030A.F/4996/4 2
Computer During Unauthorized Access
3 18:982F/7990/4 Criminal Forfeiture
(May be continued on reverse)

Date 11/19/2024 Signature of AUSA /s/Patrick Daly

Case 4:24-cr-00275-DGK Document 1-1 Filed 11/19/24 Page 1 of 1