Please note that the article is more than five years old and belongs to our archive. We do not update the content of the archives, so it may be necessary to consult newer sources.
/nginx/o/2017/02/09/6323455t1h0c72.png)
/nginx/o/2012/09/25/1339170t1h58ef.jpg)
Cyber thieves around the world stole 45 million US dollars by hacking into debit card companies, scrapping withdrawal limits and helping themselves from cash machines, US authorities said Thursday.
US prosecutors named Estonia among more than a dozen countries that aided them in the investigation.
The massive heist unfolded "in a matter of hours," the US prosecutor's office for Brooklyn, New York, was quoted by AFP as saying.
Prosecutors unveiled charges against eight people accused of forming the New York cell of the plot, which stretched across 26 countries. In their case, they allegedly lifted 2.8 million dollars in cash and now face charges of conspiracy to commit access device fraud and money laundering.
Seven of the eight have been arrested, the US attorney's office said. The eighth, Alberto Yusi Lajud-Pena, who was the leader and was nicknamed "Prime" and "Albertico," is reported to have been murdered two weeks ago, the office said.
"The defendants and their co-conspirators participated in a massive 21st century bank heist that reached across the internet and stretched around the globe," US Attorney Loretta Lynch said in a statement. Lynch would not say who masterminded the attacks globally, who the hackers were or where they were located, citing an ongoing investigation.
A spokesman for the Estonian Police and Border Guard Board told BNS on Friday the United States had not turned to Estonia with a request for legal assistance in the investigation. The spokesman, Kaarel Kuusk, said that since no criminal investigation in the said case had been opened in Estonia, Estonian law enforcement bodies were not in a position to comment.
The type of heist is known to criminals as an "unlimited operation" and two were allegedly carried out: first on December 22 last year and again on February 19-20 this year.
In the initial stage, taking several months, sophisticated hackers allegedly infiltrated credit card processors' computer networks, looking into databases of prepaid debit cards, a tool used often by employers and aid organizations. Breaking into the system, the hackers eliminated withdrawal limits imposed by banks.
Next, the hackers cybergang distributed the debit card numbers to its street associates called "cashers," who loaded other magnetic stripe cards, like gift cards, with the stolen data. Finally, the cashers were given stolen PIN numbers and sent to harvest the loot, going from ATM to ATM and withdrawing as much as cash as they could for the organization.
In the first alleged raid, hackers targeted RAKABANK in the United Arab Emirates. After manipulating the withdrawal limits, casher gangs worldwide hit the ATMs, conducting some 4,500 transactions worth 5 million dollars across about 20 countries.
In the second attack, US prosecutors say, the group broke into the Bank of Muscat based in Oman. Then in the space of 10 hours, casher cells in 24 countries conducted some 36,000 transactions, withdrawing 40 million dollars from ATMs.
The New York cell, the US attorney's office said, took 400,000 US dollars in the first raid and 2.4 million dollars on the second, when it made some 3,000 ATM withdrawals.
Such ATM fraud schemes are not uncommon, but the 45 million dollars stolen in this one was at least double the amount involved in previously known cases, Avivah Litan, an analyst who covers security issues for Gartner Inc, told AP. Middle Eastern banks and payment processors are "a bit behind" on security and screening technologies that are supposed to prevent this kind of fraud, but it happens around the world, she said.
According to the indictment of the New York defendants, they quickly moved to launder their cash, opening a Miami bank account and pouring money into cars, including a Porsche and a Mercedes, and two Rolex watches. There was no detail given on the apparent murder of their leader just over two months after the second alleged heist.
Nor did prosecutors give details of where else the alleged criminal operations unfolded abroad.
Lynch expressed gratitude for the timely and extensive assistance of law enforcement authorities in Japan, Canada, Germany, and Romania, and also thanked authorities in the United Arab Emirates, Dominican Republic, Mexico, Italy, Spain, Belgium, France, United Kingdom, Latvia, Estonia, Thailand, and Malaysia for their cooperation in this investigation.