Eleven people have been charged or indicted in a massive identity theft and computer fraud scheme involving some of the largest data breaches in recent US history, the US Department of Justice announced on Tuesday.
The participants in the scheme targeted nine US retailers, including TJX, BJ's Wholesale Club, and DSW Shoe Warehouse, DOJ officials said. Those three retailers all announced large data breaches between 2004 and 2007.
The ID theft ring stole more than 40 million credit and debit card numbers, said Michael Sullivan, US attorney for the District of Massachusetts. The criminals installed sophisticated "sniffer" programs on the retailers' networks, allowing them to collect credit card and password information, he said during a press conference.
This case is believed to be the largest hacking and ID theft case the DOJ has ever prosecuted, said US Attorney General Michael Mukasey.
On Tuesday, a federal grand jury in US District Court for the District of Massachusetts indicted Albert "Segvec" Gonzalez of Miami on charges of computer fraud, wire fraud, access device fraud, aggravated identity theft and conspiracy for his role in the scheme.
The DOJ also announced charges Tuesday against Christopher Scott and Damon Patrick Toey, both of Miami. Other defendants face numerous charges in California and New York, the DOJ said.
Three of the defendants are US citizens, one is from Estonia, three are from Ukraine, two are from China and one is from Belarus, the DOJ said. One individual is only known by an online alias, and his place of origin is unknown.
After collecting the data, the defendants allegedly concealed it in encrypted servers they controlled in Eastern Europe and the US, the DOJ said. They allegedly sold some of the credit and debit card numbers on the Internet to other criminals. The stolen numbers were cashed out by encoding card numbers on the magnetic strips of blank cards.
The defendants then used these cards to withdraw tens of thousands of dollars at a time from cash machines, the DOJ said. Gonzalez and others were allegedly able to conceal and launder their fraud proceeds by using anonymous Internet-based currencies and by channelling funds through bank accounts in Eastern Europe, the DOJ said.
The US Federal Trade Commission has sought sanctions against TJX, DSW and BJ's for their alleged failure to take appropriate security measures to protect customer information.
Gonzalez faces life in prison if he is convicted of all the charges alleged in the Massachusetts indictment.
Also on Tuesday, indictments were unsealed in US District Court for the Southern District of California in San Diego against alleged participants Maksym "Maksik" Yastremskiy of Kharkov, Ukraine, and Aleksandr "Jonny Hell" Suvorov of Sillamae, Estonia.
The two are charged with crimes related to the sale of the stolen credit card data that Gonzalez and others illegally obtained, as well as additional stolen credit card data.
Suvorov is charged with conspiracy to possess unauthorized access devices, possession of unauthorized access devices, trafficking in unauthorized access devices, identity theft, aggravated identity theft, and aiding and abetting. Yastremskiy is charged with trafficking in unauthorized access devices, identity theft, aggravated identity theft and conspiracy to launder monetary instruments.
An indictment against Hung-Ming Chiu and Zhi Zhi Wang, both of China, and a person known only by the online nickname "Delpiero," was also unsealed in San Diego Tuesday. Also in San Diego, Sergey Pavolvich of Belarus, and Dzmitry Burak and Sergey Storchak, both of Ukraine, were charged in a criminal complaint with conspiracy to traffic in unauthorised access devices.
The San Diego charges allege that Yastremskiy, Suvorov, Chiu, Wang, Delpiero, Pavolvich, Burak and Storchak operated an international stolen credit and debit card distribution ring with operations from Ukraine, Belarus, Estonia, China, the Philippines and Thailand. The indictments allege that each of the defendants sold stolen credit and debit card information. The indictment of Yastremskiy alleges that he made more than $11 million from this criminal activity.
Gonzalez is currently being held in jail on the New York charges.
Turkish officials apprehended Yastremskiy in 2007 in Turkey when he travelled there on holiday. He has been jailed there since then, pending the resolution of related Turkish charges, and the US has made a formal request for his extradition.
At the request of the DOJ, Suvorov was apprehended by the German Federal Police in Frankfurt in March 2008 on the San Diego charges when he travelled there on vacation. He is currently in jail pending the resolution of extradition proceedings.