Eleven charged in hacking ring that allegedly stole 40 million card numbers

August 5, 2008 03:08 PM Email| Comments (0)| Text size – +

By Globe Staff

Eleven people from at least five different countries are facing charges for their involvement in a wide-ranging scheme to hack into nine US companies and steal and sell more than 40 million credit and debit card numbers, federal law enforcement officials said today in Boston.

Attorney General Mukasey

"As far as we know, this is the single largest and most complex identity theft case that's ever been charged in this country," Attorney General Michael Mukasey said. Officials said the ring had stolen hundreds of millions of dollars.

Three of the defendants are US citizens, one is from Estonia, three are from Ukraine, two are from China, and one is from Belarus, the US attorney's office in Boston said. The 11th defendant is known only by an online alias.

A grand jury indictment handed up today in Boston charges that Albert "Segvec" Gonzalez of Miami and his conspirators began by "wardriving" -- or driving around and looking to eavesdrop on wireless networks. They then allegedly hacked into the wireless networks of TJX, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Dave & Buster's, Sports Authority, Forever 21, and DSW.

Once they gained access to the systems, they installed programs that would capture card numbers as well as password and account information, officials said.

The conspirators then allegedly concealed the data in encrypted computer servers they controlled in Eastern Europe and the United States, selling some of the numbers, via the Internet, to other criminals. Some of the cards they kept were "cashed out" by encoding the stolen numbers on the magnetic strips of blank cards, which were then used to take tens of thousands of dollars out of ATMs, officials said.

Part of the scheme came to the public's attention in early 2007, when TJX, the Framingham-based retailer that runs T.J. Maxx, Marshalls, and other stores announced that it had discovered that credit and debit card information had been stolen from its computer systems.

Two other Miami residents were charged in Boston, while eight other people were charged in San Diego.

Mukasey said in a Boston news conference that the case, which required close cooperation from investigative agencies from around the world, would send a clear message to other cybercriminals.

"The message is simply this: We will track you down wherever you are in the world. We will see that you are arrested and you will go to jail," he said.

Massachusetts US Attorney Michael Sullivan said that "because of the size and scope of this criminal activity, Gonzalez faces life in prison" if he is convicted.

Christopher Scott and Damon Patrick Toey of Miami were also charged in Boston. Maksym "Maksik" Yastermskiy, Dzmitry Burak, and Sergey Storchak of Ukraine; Aleksandr "Jonny Hell" Suvorov of Estonia; Hung-Ming Chiu and Zhi Zhi Wang of China; Sergey Pavlovich of Belarus; and a person only known by the online nickname of "Delpiero" were all charged in San Diego.