A group of Eastern European hackers have been charged by federal prosecutors with stealing credit card information from companies including J.C. Penney, Nasdaq OMX Group, and 7-Eleven. The crime spree carried on for over half a decade and caused hundreds of millions of dollars in losses, according to the Wall Street Journal.
The hacking allegedly started in 2005 according to criminal charges unsealed on Thursday. This might be the largest hacking operation ever prosecuted in the U.S., both current and former U.S. officials told the WSJ. Many of the data breaches occurring under the operation have already been covered in prior court filings.
The unsealed charges give a much more information than is typical for these sorts of cases. Companies usually attempt to keep such proceedings quiet in order to maintain customer trust. Admitting that they have been hacked and had credit card numbers and other personal information stolen is usually the last thing a company wants to do.
Members of the hacking group, comprised of four Russians and a Ukrainian, researched potential targets to identify payment-processing systems. This research included visited retail stores in 2007 and 2008.
As stated in the charges, the group would occasionally install software on company computers that created digital back doors. This meant they could access infected computers whenever they decided it was time to carry out the actual attack.
The attacks themselves were done using a network of rented computers spread across the world. They were located in the Bahamas, Latvia, Panama, New Jersey, and other areas, reports the WSJ. In order to evade law enforcement, the group is alleged to have enabled Google alerts for words phrases like “data breach” and “identity theft. The group wanted to be informed as soon as news of the breaches was reported.
The group is also alleged to have once worked with Albert Gonzalez, a man from Miami sentenced to 20 years in 2010 for hacking. His sentence is currently the longest for any hacking case in the U.S. so far.
The indictment revealed Thursday lists Aleksandr Kalinin, 32-year-old Vladimir Drinkman, 29-year-old Dmitriy Smilianets, Roman Kotov, and Mikhail Rytikov. Currently, Kalinin, Kotov, and Rytikov are fugitives. Former U.S. officials have claimed that if they seek refuge in Russia, extradition is not likely. The two other members, Smilianets and Drinkman, were arrested in the Netherlands in June of last year. Smilianets should appear in federal court in New Jersey as soon as next week.
In addition to other charges, Kalinin has also been charged with two other breaches. In one, he was involved in hacking Nasdaq’s servers. In the other, he stole information concerning over 800,000 bank accounts, leading to theft of over $7.8 million. Another man, Nikolay Nasenkov, has also been charged in the bank case. He faces a slew of charges and may be sentenced to up to 30 years in prison. Nasenkov’s whereabouts are currently unknown.
While nothing has yet been proven, the five men named in the recently unsealed indictment allegedly stole over 160 million credit and debit card numbers plus other personal information.
The group is said to have sold this data, gaining approximately $10 for every stolen American credit card number, $15 for each Canadian number, and as much as $50 for each European number. From three of the companies alone, over $300 million was allegedly stolen, according to the indictment.
Some other alleged victims of the attacks include Dow Jones, French retailer Carrefour, JetBlue Airways. Also attacked was a Jordian company that “processed payments for merchants using Visa Inc.’s network,” according to the WSJ.
The investigation is still ongoing.
Read the original story here.
Image: 46468512@N00 @ Flickr.
The post Hacker Group Charged with Stealing 160 Million Card Numbers appeared first on Credit Card Processing Space.
