40 million stolen credit cards later, DoJ charges 11 hackers

A group of hackers who perpetrated numerous credit card and personal identification thefts are being charged with numerous crimes ranging from conspiracy, computer intrusion, fraud, and identity theft. Altogether, this constitutes the largest hacking and identity theft case ever prosecuted by the Department of Justice. HangZhou Night Net

Eleven perpetrators from around the world are being charged with the theft and illegal sales of credit card numbers and personal information stolen from retail stores like TJ Maxx, Office Max, Boston Market, Barnes & Noble, Sports, Authority, Forever 21, DSW, and more. After obtaining the data, the perpetrators stored it in an encrypted format (a step that others could learn from) on servers in Eastern Europe and the US, then sold the data to customers in those countries. Credit card numbers were typically imprinted onto blank cards, then used to withdraw tens of thousands of dollars from ATMs.

One perpetrator, Albert Gonzalez, had previously been arrested by the Secret Service in 2003 for access device fraud. Gonzalez was acting as a confidential informant for the agency during the course of this most recent investigation, but was found out to be criminally involved with another case of stealing credit card data from the Dave & Buster's chain. Because of this, he faces a maximum penalty of life in prison if he is convicted of all charges.

Courts in various cities will hear the charges brought against this retail hacking ring. For example, a San Diego indictment against Hung-Ming Chiu and Zhi Zhi Wang, both of the People's Republic of China, and a person known only by the online nickname "Delpiero" (a real name and origin are unknown) charges the three with conspiracy to possess unauthorized access devices, trafficking in unauthorized access devices, trafficking in counterfeit access devices, possession of unauthorized access devices, aggravated identity theft, and aiding and abetting.

With the help of Sergey Pavolvich, of Belarus, and Dzmitry Burak and Sergey Storchak of Ukraine, these eight perpetrators are charged with operating an international stolen credit and debit card distribution ring, and selling these cards for personal gain. As an example, the indictment cites Yastremskly alone as receiving over $11 million from these activities. Suvorov and Yastremskiy were charged in May with accompanying Gonzalez when hacking the Dave & Buster's chain.

"So far as we know, this is the single largest and most complex identity theft case ever charged in this country," said Attorney General Mukasey in the DoJ press release. "It highlights the efforts of the Justice Department to fight this pernicious crime and shows that, with the cooperation of our law enforcement partners around the world, we can identify, charge and apprehend even the most sophisticated international computer hackers." It also highlights the risk to consumers when retailers are lax with data they collect on consumers in the ordinary course of business.