WASHINGTON - Over the past few years and months authorities have been arresting suspects they believe were responsible for the massive data security thefts at BJ’s Wholesale Club, Dave & Buster’s and TJX Cos., all of which forced credit unions to reissue tens of thousands of credit and debit cards at significant costs.
Last week the Department of Justice tied those cases–as well as several other cards breaches–together with charges against 11 suspects they say hacked into national merchants then sold account information over the Internet for the manufacture of counterfeit cards. “So far as we know, this is the single largest and most complex identity theft case ever charged in this country,” said Attorney General Michael Mukasey.
‘Wardriving,’ Hacking & Stealing
The group was charged with stealing credit and debit card numbers by “wardriving” and hacking into the wireless computer networks of major retailers, including TJX, BJ’s Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Dave & Busters, Sports Authority, Forever 21 and DSM. Once inside the networks, they installed “sniffer” programs that would capture card numbers, as well as password and account information.
A federal grand jury claims the group then hid the data on encrypted computer servers they controlled in Eastern Europe and the U.S., and sold card information over the Internet to individuals who used the data to create counterfeit cards. The cards were used to withdraw millions of dollars in cash from ATMs around the world, and to buy merchandise.
CU executives around the country that have been reissuing cards by the thousands over the last few years, were gratified by the charges. “I’m really pleased that they caught these people,” said James Blake, president of HarborOne CU in Brockton, Mass., which has spent more than $150,000 in recent years to resolve card breaches–without insurance reimbursement. “It’s significant that it’s the same people that participated in the breaches.”
Jim Blaine, CEO of North Carolina State Employees CU, said SECU reissued cards in most of the cases attributed to the group at a cost of more than $100,000, that was not reimbursed by insurance. “Whether it’s two cards or 17,000, we reissue the cards,” said Blaine, explaining the cost to reissue was worth the threat to his members.
But he was doubtful the arrests will stem the growing incidents of card identity theft. “There’s always another 14-year-old out there who is three years ahead of you in security,” Blaine said.
HarborOne’s Blake also questioned whether the arrests will stem the tide of data security breaches. He cited the recent breach at the northeast supermarket chain of Hannaford Bros., for which his CU is still reissuing cards, noting it was not attributed to the ring. “I don’t, in any way, think that this is going to stop, or that this is the end of it,” said Blake.
Jeff Post, chief executive of CUNA Mutual Group, which is suing BJ’s Wholesale over that company’s 2004 data breach, expressed satisfaction at last week’s charges. “These breaches remain crimes of opportunity,” Post said. “Data breaches such as TJX are enabled by retailers who continue to store personal account information against card association rules and with disregard for the safety of these very organizations’ customer’s credit card information. If merchants would simply follow the card association rules, this supply of plastic card data would not be available to steal.”
Alleged Perpetrators Revealed
Among those charged in the case are Albert “Segvec” Gonzalez, of Miami, who was arrested by the Secret Service in 2003 and has been working as an undercover informant for the Feds since then.
Others charged included: Maksym Yastremskiy, a Ukrainian, who has been in custody in Turkey since last year; Aleksandr “Jonny Hell” Suvorov, from Estonia; Hung-Ming Chiu and Zhi Zhi Wang, both of China; Sergey Pavolvich of Belarus; Dzmitry Burak and Sergey Storchak, both of the Ukraine.
Yastremskiy, who was arrested when he traveled to Turkey for vacation last July, is alleged to have earned more than $11 million for his role in the ring. American authorities have made a formal request to the Turkish government for his extradition to stand trial in the U.S.
Suvorov was arrested in Frankfurt, Germany in March when he traveled there on vacation, and is being held pending extradition proceedings.(c) 2008 The Credit Union Journal and SourceMedia, Inc. All Rights Reserved.http://www.cujournal.com http://www.sourcemedia.com
