Feeds

Five charged as Feds bust largest credit-card hack in history

Hundreds of millions stolen from biggest names in US

High performance access to file storage

Federal prosecutors in New Jersey say they've busted what could be the biggest credit card hacking fraud in US history, with companies such as NASDAQ, 7-Eleven, and Dow Jones falling prey to an Eastern European criminal gang.

According to the indictment, the gang stole data on up to 160 million credit cards and then sold them on in underground forums so that they could be written onto blank cards and be used to withdraw funds. The losses for just three of the many companies they targeted came to over $300m, according to the authorities.

"This type of crime is the cutting edge. Those who have the expertise and the inclination to break into our computer networks threaten our economic well-being, our privacy, and our national security," said US Attorney Paul Fishman in a statement.

"This case shows there is a real practical cost because these types of frauds increase the costs of doing business for every American consumer, every day. We cannot be too vigilant and we cannot be too careful."

The five men – four Russians and a Ukrainian national – were charged with conspiracy to gain unauthorized access to computers and wire fraud, with additional charges that could see four of the five each facing an extra 120 years in prison.

The government alleges that two of the Russians, Vladimir Drinkman, 32, and Alexandr Kalinin, 26, were the group's hacking team who carried out the penetration of target firms, usually exploiting SQL attacks and then installing trojan software to harvest credit card and personal information from corporate servers.

The two are well known to prosecutors as former associates of cybercrime-kingpin-turned-US-Secret-Service-snitch-turned-recidivist-cyberblagger Albert Gonzalez and are thought to have been the duo behind the successful 2009 hacking of Heartland Payment Systems.

Once the data had been slurped it was passed over to the team's Russian analyst Roman Kotov, 32, who identified the most valuable credit cards and the ancillary information needed to use the numbers for fraudulent traffic, the government claims.

This was then passed on to Muscovite Dmitriy Smilianets, 29, for resale on undergrounds message boards, with the Ukrainian Mikhail Rytikov, 26, providing the anonymous ISP services to enable the sale.

The gang sold US credit-card data ready to be slapped onto a blank card for around $10 per number, while Canadian cards went for $15, and European cards for $50 per user. The gang sold only to credentialed underground buyers, and offered volume discounts for larger buyers.

Drinkman and Smilianets were arrested in the Netherlands in June 2012 after the Dutch police were tipped off by the US authorities and are currently being extradited to the US for trial. Kalinin, Kotov, and Rytikov are still at large.

"As is evident by this indictment, the Secret Service will continue to apply innovative techniques to successfully investigate and arrest transnational cyber criminals," said Special Agent in Charge Mottola of the Newark, New Jersey, Field Office.

"While the global nature of cyber-crime continues to have a profound impact on our financial institutions, this case demonstrates the global investigative steps that U.S. Secret Service Special Agents are taking to ensure that criminals will be pursued and prosecuted no matter where they reside." ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.