U.S. attorneys in New York and New Jersey unsealed indictments Thursday against five men accused of hacking the computer networks of several major corporations. Prosecutors allege the men — four Russians and a Ukrainian — stole hundreds of millions of dollars and some 160 million credit and debit card numbers.
Copyright NPR. View this article on npr.org.
DAVID GREENE, HOST:
And let's move, now, to what appears to be the largest case of electronic data theft ever uncovered by U.S. law enforcement. As NPR's Steve Henn reports, U.S. attorneys in New York and New Jersey have unveiled indictments against a Russian-dominated hacking conspiracy.
STEVE HENN, BYLINE: Law enforcement described the scale of these criminal hacks as stunning. According to Paul Fishman, the U.S. attorney for the District of New Jersey, in eight years, the group stole and then sold more than 160 million card numbers. Their hacks led to more than $300 million in losses.
PAUL FISHMAN: And that, by the way, is our conservative estimate of the losses - the amount we've been able to confirm so far; and suffered by only three of the victim companies.
HENN: And Fishman said more than a dozen companies were victimized.
FISHMAN: Seventeen major data breaches, including intrusions into the networks of NASDAQ, 7-Eleven, J.C. Penney, Heartland Payment Systems...
HENN: Members of the group hit banks, including Citibank and PNC. The hackers used a variety of techniques to get the information they wanted. Sometimes, they planted malware on corporate servers; sometimes, they attacked corporate databases directly. And on several occasions, they attacked financial institution websites, creating programs that would guess at an account password again and again - automatically - until they got a hit. In fact, in a single day in 2008, they were able to compromise more than 300,000 Citibank accounts using that technique.
FISHMAN: Sometimes, these attacks and these explorations would take months and months and months. It was not unusual at all for them to spend that kind of time looking for valuable data within a victim's computer network.
HENN: Fishman says that data fueled a global business, selling card numbers to groups of identity theft wholesalers around the world. Kimberly Peretti, who spent eight years as a prosecutor in the cybercrime division of the Justice Department, says taking down a ring that's this sophisticated is incredibly difficult.
KIMBERLY PERETTI: Targets in different countries, witnesses in different countries - it requires an enormous, global law enforcement effort.
HENN: According to investigators, these five hackers were highly specialized, and very good at what they did. One, Mikhail Rytikov from Ukraine, worked only on covering their tracks. Rytikov and two colleagues are still at large.
Steve Henn, NPR News, Silicon Valley.
(SOUNDBITE OF MUSIC) Transcript provided by NPR, Copyright NPR.