Florida woman gets 2 year sentence for trafficking Microsoft software labels

A Florida woman has been sentenced to nearly two years in prison for trafficking in Microsoft software authentication labels and reselling the product keys extracted from them, U.S. prosecutors said Monday.

Heidi Richards, 52, was sentenced to 22 months in federal prison and ordered to pay a $50,000 fine, according to a statement from the U.S. Attorney’s Office.

Prosecutors said Richards operated an e-commerce business called Trinity Software Distribution and purchased tens of thousands of genuine Microsoft “certificate of authenticity” (COA) labels between July 2018 and January 2023 from a Texas-based supplier.

COA labels are stickers typically affixed to computers to verify that a copy of Microsoft software, such as Windows 10 or Microsoft Office, is genuine. They contain product key codes used to activate the software and include security features designed to deter counterfeiting.

Federal law prohibits selling those labels separately from the licensed software and hardware they are intended to accompany.

According to court documents, Richards and her co-conspirators paid millions of dollars for the labels at prices significantly below the retail value of the associated software. Instead of selling the labels with the corresponding software, Richards directed employees to manually extract the product key codes and record them in spreadsheets.

The license keys were then sold in bulk to customers worldwide. Between 2018 and 2023, Richards wired more than $5.1 million to the supplier, according to the indictment.

Prosecutors said the illicit resale of the keys exploited a secondary market for COA labels, which have no independent commercial value apart from the licenses and hardware they are meant to accompany.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Daryna Antoniuk

Daryna Antoniuk

is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

 

Total
0
Shares
Previous Post

Building a High-Impact Tier 1: The 3 Steps CISOs Must Follow

Next Post

Fake Tech Support Spam Deploys Customized Havoc C2 Across Organizations

Related Posts

GootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection

The JavaScript (aka JScript) malware loader called GootLoader has been observed using a malformed ZIP archive that's designed to sidestep detection efforts by concatenating anywhere from 500 to 1,000 archives. "The actor creates a malformed archive as an anti-analysis technique," Expel security researcher Aaron Walton said in a report shared with The Hacker News. "That is, many unarchiving tools
Read More

Gainsight Expands Impacted Customer List Following Salesforce Security Alert

Gainsight has disclosed that the recent suspicious activity targeting its applications has affected more customers than previously thought. The company said Salesforce initially provided a list of 3 impacted customers and that it has "expanded to a larger list" as of November 21, 2025. It did not reveal the exact number of customers who were impacted, but its CEO, Chuck Ganapathi, said "we
Read More