Feeds

Romanians plead guilty to credit card hack on US Subway shops

$10m PoS pwn

Using blade systems to cut costs and sharpen efficiencies

Two Romanian nationals who were extradited to the US in May have confessed their involvement in a $10m scam aimed at stealing credit and debit card data from payment terminals at hundreds of Subway restaurants and other merchants across the US, according to the United States Attorney's Office.

Iulian Dolan, 28, of Craiova, Romania, pleaded guilty to conspiracy to commit computer fraud and two counts of conspiracy to commit access device fraud. Cezar Butu, 27, of Ploiesti, Romania, pleaded guilty to one count of conspiracy to commit access device fraud. Each agreed to plead guilty in return for lesser sentences as part of a plea-bargaining agreement that will see Dolan jailed for no more than seven years and Butu for no more than 21 months, providing a sentencing judge approves the deal.

The pair were among four Romanian nationals extradited in May after being charged last December with hacking into Subway vulnerable point-of-sale computers between 2009 and 2011. The scheme led to the compromise of more than 146,000 payment cards and more than $10m in losses.

The hack against point-of-sale terminals relied on identifying machines running exploitable remote desktop software applications. The US Dept of Justice said Dolan had hacked into these systems to install keystroke logging applications, which subsequently recorded card data from swiped cards before transferring this information to dump sites. In some cases Dolan had to crack passwords in order to circumvent the remote desktop applications, which in normal use were used to update the software on PoS terminals.

Butu has admitted to attempting to make fraudulent transactions using the stolen credit card data as well as selling the plastic cards data to co-conspirators. The confessions implicate alleged ring-leader Adrian-Tiberiu Opera, a Romanian national extradited to the US and awaiting trial in New Hampshire over his alleged involvement in the scam.

A US DoJ statement on the case can be found here. Subway is not named as the target of the scam by the DoJ in its latest statement but it is named in prior DoJ statements as being one of the victims of the hack – along with around 50 other merchants. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.