Not bad - 12 hours $9 million!
Hackers Indicted in Widespread ATM Heist
By SIOBHAN GORMAN and EVAN PEREZ
November 11, 2009
WASHINGTON -- The U.S. Justice Department indicted eight Russian and Eastern European computer hackers, alleging they were part of a crime ring that allegedly broke into ATMs in hundreds of cities world-wide and stole $9 million in a matter of hours.
Prosecutors in Atlanta announced indictments Tuesday in a scheme that is among the most brazen and damaging electronic-bank heists disclosed to date. One of the men accused was arrested and is awaiting extradition from Estonia. The others are thought to be at large.
The alleged hackers cracked a computer system at RBS WorldPay Inc., the U.S. payment processing division of Royal Bank of Scotland Group PLC, and cloned prepaid ATM cards, which thieves then used to withdraw cash from 2,100 ATMs from 280 cities around the world, including in the U.S. The synchronized operation, which began November 8, 2008, took no more than 12 hours.
The RBS case is part of a boom in online theft from financial institutions. "More money is stolen electronically or [in] data breaches than through bank robberies," Shawn Henry, assistant Director of the Federal Bureau of Investigation's Cyber Division, said in an interview.
The alleged hackers targeted payroll debit cards that companies issue employees for withdrawing their salaries. Once the hackers entered the systems, they boosted the maximum allowed withdrawal and then tried to destroy data on the systems to cover up the break-in, prosecutors alleged.
Prosecutors in Atlanta announced indictments Tuesday in a scheme that is among the most brazen and damaging electronic-bank heists disclosed to date. One of the men accused was arrested and is awaiting extradition from Estonia. The others are thought to be at large.
The alleged hackers cracked a computer system at RBS WorldPay Inc., the U.S. payment processing division of Royal Bank of Scotland Group PLC, and cloned prepaid ATM cards, which thieves then used to withdraw cash from 2,100 ATMs from 280 cities around the world, including in the U.S. The synchronized operation, which began November 8, 2008, took no more than 12 hours.
The RBS case is part of a boom in online theft from financial institutions. "More money is stolen electronically or [in] data breaches than through bank robberies," Shawn Henry, assistant Director of the Federal Bureau of Investigation's Cyber Division, said in an interview.
The alleged hackers targeted payroll debit cards that companies issue employees for withdrawing their salaries. Once the hackers entered the systems, they boosted the maximum allowed withdrawal and then tried to destroy data on the systems to cover up the break-in, prosecutors alleged.
BloombergThe most serious charges in the 16-count grand jury indictment were against four conspirators and ranged from wire fraud to aggravated identity theft. Others faced lesser charges. RBS ensured that its customers were reimbursed for stolen funds.
The losses could have been much greater had the hacker ring been able to assemble a larger network of accomplices, Mr. Henry said. "The size of the human network was a limiting factor, [because] some of the ATMs ran out of money," Mr. Henry said.
The RBS hackers are one of two major cyber gangs law enforcement officials have targeted in recent years for wreaking havoc on U.S. financial companies. The second is the group responsible for online attacks on TJX Cos., Heartland Payment Systems Inc., and others. That gang's ringleader, U.S. citizen Albert Gonzalez, was indicted in August along with his conspirators.
Security sleuths say the RBS gang was considerably more sophisticated than Mr. Gonzalez's crew. "This investigation has broken the back of one of the most sophisticated computer hacking rings in the world," said Acting U.S. Attorney Sally Quillian Yates of the Northern District of Georgia.
A class-action lawsuit against RBS WorldPay is pending in the same district, alleging the company failed to adequately protect customer data.
One alleged leader of the gang is Viktor Pleshchuk, 28, of St. Petersburg, Russia, who manipulated the data and managed the hackers' use of the RBS WorldPay computer network with the help of several others, according to the indictment. He developed a method used to reverse-engineer personal identification numbers from encrypted data on the network of RBS WorldPay, the indictment said.
Another of the key conspirators, Sergei Tsurikov, 25 years old, of Tallinn, Estonia, was responsible for conducting reconnaissance on the RBS WorldPay system and supported other hacking activities, according to the indictment. He shared information with Mr. Pleshchuk.
Mr. Tsurikov is awaiting extradition to the U.S. from Estonia. In a new arrangement between the U.S. and Estonia, he would be the first cybercriminal to be extradited from Eastern Europe, which has become a haven for the cyber underground.
The RBS caper also relied on one of the U.S. Secret Service's most-wanted criminals, Oleg Covelin, 28, of Chisinau, Moldova, according to the indictment. Mr. Covelin distributed the account information to others to withdraw money from ATMs. Lawyers for the three men couldn't be located.
Preparations for the heist began on November 4 when the four key players broke into RBS WorldPay's computer network from a location outside the U.S., according to the indictment.
The thieves distributed approximately 44 prepaid payroll card numbers and their personal identification numbers to their network of "cashers."
On November 8, 2008, the thieves signaled the network of cashers to begin withdrawing money. Over the next 12 hours, more than $9 million disappeared from accounts in 280 cities from Atlanta to Hong Kong.
The cashers were allowed to keep up to half the cash they stole and sent the rest back to the ringleaders, according to the indictment.
RBS WorldPay detected the breach on November 10 and disclosed it publicly on December 23, acknowledging that the data of 1.5 million cardholders was compromised. The company also said at the time that 1.1 million social security numbers may have been compromised, although the indictment makes no mention of that.
"RBS WorldPay has been and will continue to cooperate with the law enforcement agencies involved with the investigation," the company said Tuesday in a statement.
The Justice Department launched an investigation, working with authorities in countries from Estonia to Hong Kong. Mr. Henry, the FBI official, commended RBS for its cooperation. Companies sometimes delay providing information in breach probes, fearing lost customers.
Mr. Henry declined to describe how the alleged hacking ring was organized. But he said that, generally, some rings become virtual organized-crime groups. "They share expertise and techniques, though they might be located multiple countries and have never met each other," he said.
Write to Siobhan Gorman at siobhan.gorman@wsj.com and Evan Perez at evan.perez@wsj.com
The losses could have been much greater had the hacker ring been able to assemble a larger network of accomplices, Mr. Henry said. "The size of the human network was a limiting factor, [because] some of the ATMs ran out of money," Mr. Henry said.
The RBS hackers are one of two major cyber gangs law enforcement officials have targeted in recent years for wreaking havoc on U.S. financial companies. The second is the group responsible for online attacks on TJX Cos., Heartland Payment Systems Inc., and others. That gang's ringleader, U.S. citizen Albert Gonzalez, was indicted in August along with his conspirators.
Security sleuths say the RBS gang was considerably more sophisticated than Mr. Gonzalez's crew. "This investigation has broken the back of one of the most sophisticated computer hacking rings in the world," said Acting U.S. Attorney Sally Quillian Yates of the Northern District of Georgia.
A class-action lawsuit against RBS WorldPay is pending in the same district, alleging the company failed to adequately protect customer data.
One alleged leader of the gang is Viktor Pleshchuk, 28, of St. Petersburg, Russia, who manipulated the data and managed the hackers' use of the RBS WorldPay computer network with the help of several others, according to the indictment. He developed a method used to reverse-engineer personal identification numbers from encrypted data on the network of RBS WorldPay, the indictment said.
Another of the key conspirators, Sergei Tsurikov, 25 years old, of Tallinn, Estonia, was responsible for conducting reconnaissance on the RBS WorldPay system and supported other hacking activities, according to the indictment. He shared information with Mr. Pleshchuk.
Mr. Tsurikov is awaiting extradition to the U.S. from Estonia. In a new arrangement between the U.S. and Estonia, he would be the first cybercriminal to be extradited from Eastern Europe, which has become a haven for the cyber underground.
The RBS caper also relied on one of the U.S. Secret Service's most-wanted criminals, Oleg Covelin, 28, of Chisinau, Moldova, according to the indictment. Mr. Covelin distributed the account information to others to withdraw money from ATMs. Lawyers for the three men couldn't be located.
Preparations for the heist began on November 4 when the four key players broke into RBS WorldPay's computer network from a location outside the U.S., according to the indictment.
The thieves distributed approximately 44 prepaid payroll card numbers and their personal identification numbers to their network of "cashers."
On November 8, 2008, the thieves signaled the network of cashers to begin withdrawing money. Over the next 12 hours, more than $9 million disappeared from accounts in 280 cities from Atlanta to Hong Kong.
The cashers were allowed to keep up to half the cash they stole and sent the rest back to the ringleaders, according to the indictment.
RBS WorldPay detected the breach on November 10 and disclosed it publicly on December 23, acknowledging that the data of 1.5 million cardholders was compromised. The company also said at the time that 1.1 million social security numbers may have been compromised, although the indictment makes no mention of that.
"RBS WorldPay has been and will continue to cooperate with the law enforcement agencies involved with the investigation," the company said Tuesday in a statement.
The Justice Department launched an investigation, working with authorities in countries from Estonia to Hong Kong. Mr. Henry, the FBI official, commended RBS for its cooperation. Companies sometimes delay providing information in breach probes, fearing lost customers.
Mr. Henry declined to describe how the alleged hacking ring was organized. But he said that, generally, some rings become virtual organized-crime groups. "They share expertise and techniques, though they might be located multiple countries and have never met each other," he said.
Write to Siobhan Gorman at siobhan.gorman@wsj.com and Evan Perez at evan.perez@wsj.com
posted by Clare L. Pieuk at 12:20 PM
0 comments
links to this post
There are nine candidates in the 2009 list ranging from a "mere" $7,500 for A distillers Experence to a "modest" $105,000 for a 2010 XJL Supercharged Jaguar to the "expensive" $250,000 ICON A5 Sports Aircraft and Pilot Training For Two. Our favorite? The $25,000 Customized Cupcake Car: 
Hope you finished taking down the telegraph poles and are still enjoying your victrola.
From: Don 
Sincerely,
Vietnam war veteran Ron Parkes objects to the release of the war game right before Remembrance Day.
