BOSTON – Authorities yesterday said they have charged 11 individuals, most of them foreign nationals, with the 2007 theft of as many as 40 million credit card accounts from TJX Cos., as well as several other card breaches that have cost credit unions around the country millions of dollars to plug.
The group was charged with stealing credit and debit card numbers by “wardriving” and hacking into the wireless computer networks of major retailers, including TJX, BJ’s Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Dave & Busters, Sports Authority, Forever 21 and DSM. Once inside the networks, they installed “sniffer” programs that would capture card numbers, as well as password and account information.
A federal grand jury claims the group then hid the data on encrypted computer servers they controlled in Eastern Europe and the U.S., and sold card information over the Internet to individuals who used the data to create counterfeit cards. The cards were used to withdraw millions of dollars in cash from ATMs around the world, and to buy merchandise.
Jim Blaine, president of North Carolina State Employees CU, said his credit union reissued cards in most of those cases at a cost of more than $100,000, which was not reimbursed by insurance. “Whether it’s two cards or 17,000, we reissue the cards,” said Blaine, explaining the cost to reissue was worth the threat to his members. But he was doubtful the arrests will stem the growing incidents of card identity theft. “There’s always another 14-year-old out there who is three years ahead of you in security,” Blaine told The Credit Union Journal yesterday.
Jeff Post, chief executive of CUNA Mutual Group, which is suing BJ’s Wholesale over that company’s 2004 data breach, expressed satisfaction with yesterday’s news. “The efforts of law enforcement to bring the perpetrators of these data thefts to justice are commendable,” said Post.
“These breaches remain crimes of opportunity,” Post said. “Data breaches such as TJX are enabled by retailers who continue to store personal account information against card association rules and with disregard for the safety of these very organizations’ customers’ credit card information. If merchants would simply follow the card association rules, this supply of plastic card data would not be available to steal.”
Among those charged in the case was Albert “Segvec” Gonzalez, of Miami, who was arrested by the Secret Service in 2003 and has been working as an undercover informant for the Feds since then.
Others charged included: Maksym Yastremskiy, a Ukrainian who has been in custody in Turkey since last year; Aleksandr “Jonny Hell” Suvorov from Estonia; Hung-Ming Chiu and Zhi Zhi Wang, both of China; Sergey Pavolvich of Belarus; and, Dzmitry Burak and Sergey Storchak, both of the Ukraine.
Yastremskiy, who was arrested when he traveled to Turkey for vacation last July, is alleged to have earned more than $11 million for his role in the ring. American authorities have made a formal request to the Turkish government for his extradition to stand trial in the U.S.
Suvorov was arrested in Frankfurt, Germany, in March when he traveled there on vacation, and is being held pending extradition proceedings.
