NEW YORK – Three foreign nationals were arrested and charged with siphoning more than $2 million from Citibank-branded ATMs at 7-Eleven convenience stores across the country in the biggest remote PIN code theft on record.
The hackers used the stolen information to make counterfeit cards and withdraw cash from the 7-Eleven machines, which are connected to most credit union systems through Cardtronics Inc., which owns the ATMs. It is not clear if credit unions or their members were affected by the breach.
Cardtronics last week issued a statement saying all of its ATMs have encrypted PIN pads, as well as triple data encryption (Triple DES), as required by the various electronic funds transfer networks. “Additionally, Cardtronics’ processing platform complies with the PIN Security Requirements established by the Payment Card Industry (PCI) and has successfully completed a PCI PIN security field review performed by one of the major networks.”
Cardtronics last year acquired the 5,700 ATMs inside 7-Elevens from the convenience store chain. The machines are connected to the credit union-owned CO-OP Financial Services network, Credit Union 24, and Financial Services Centers Cooperative’s shared branching network.
The suspects were identified as Ivan Biltse, Angelina Kitaeva and Yuriy Rakushchynets, the latter a 32-year-old Ukrainian believed to be the ringleader. Authorities seized $800,000 in cash when they raided Rakushchynets’ Brooklyn home.
Authorities are investigating how the thieves tapped into the Citibank accounts. It is one of the first cases where criminals were able to access accounts through PINs. It is believed the hackers broke into the ATM network through a server at a third-party processor.
