Print

Mail

wiki links

Prosecutors charge 11 in hacking ring

Customers shop at a TJ Maxx store on Tuesday in La Canada, California. The US Justice Department has charged 11 people with stealing more than 40 million credit and debit card numbers from customers shopping at TJ Maxx and other retailers. PHOTO:　AFP

NY Times News Service, NEW YORK

Federal prosecutors have charged 11 people with stealing more than 41 million credit and debit card numbers, cracking what officials said on Tuesday appeared to be the largest hacking and identity theft ring ever exposed.

The thieves focused on major national retail chains like OfficeMax, Barnes & Noble, BJ’s Wholesale Club, the Sports Authority and T.J. Maxx — the discount clothes retailer that first suggested the existence of the ring early last year, when it said its systems had been breached by hackers.

Underscoring the multinational, collaborative aspect of organized crime today, three of the defendants are US citizens, one is from Estonia, three are from Ukraine, two are from China and one is from Belarus. The name and whereabouts of the final defendant are unknown.

Federal officials said a principal organizer of the ring was Albert Gonzalez, a man from Miami who was indicted on Tuesday by a federal grand jury in Boston on charges of computer fraud, wire fraud, aggravated identity theft, conspiracy and other charges. If convicted on all counts, Gonzalez would face life in prison.

“As [computer networks] provide extraordinary opportunities for legitimate commerce and communication, they also provide extraordinary opportunities for criminals.”

— Michael Mukasey, US attorney general

Gonzalez and several of his cohorts drove around and scanned the wireless networks of retailers to find security holes — known as “war driving,” prosecutors said.

Once the thieves identified technical weaknesses in the networks, they installed so-called sniffer programs, obtained from collaborators overseas. Those programs tapped into the retailers’ networks for processing credit cards and intercepted customers’ PINs and debit and credit numbers that were stored there. The thieves then spirited that information away to computers in the US, Latvia and Ukraine.

Officials say the conspirators sold credit card numbers online and imprinted other stolen numbers on the magnetic stripes of blank cards so that they could withdraw thousands of dollars from ATMs.

“Computer networks and the Internet are an indispensable part of the world economy. But even as they provide extraordinary opportunities for legitimate commerce and communication, they also provide extraordinary opportunities for criminals,” said US Attorney General Michael Mukasey at a news conference in Boston to announce the indictments.

Gonzalez was first arrested by the Secret Service in 2003 on similar charges.

He was subsequently placed on supervised pretrial release and became an informant to the agency in its campaign against organizers of ShadowCrew, a bulletin board where hackers traded stolen financial information.

But prosecutors said that Gonzalez continued his criminal activities and tried to warn one of his conspirators, Damon Patrick Toey, to ensure that Toey would not be identified or arrested in the operation against ShadowCrew. Toey was among those indicted on Tuesday in Massachusetts.

“As soon as we became aware that Gonzalez was also working with criminals and getting them information, we immediately took action,” said Mark Sullivan, director of the Secret Service.

A lawyer for Gonzalez could not be located.

To sell card numbers on the black market, the group turned to Maksym Yastremskiy of Ukraine and Alexander Suvorov of Estonia, who were also charged, prosecutors said.

Yastremskiy, thought to be a major figure in the international sale of stolen credit card information, was apprehended in July last year on vacation in Turkey and is in prison awaiting trial on charges including credit card theft. The US has asked Turkey to extradite him.
This story has been viewed 852 times.