US charges cyber-crooks over US$45 million ATM crime

US officials have charged 8 people with taking part in two cyber-attacks that resulted in US$45 million of fraudulent cash withdrawals from ATMs in 27 countries.  According to the US Justice Department, the gang broke into the computers of two credit card processors, one in India in December 2012 and the other in the United States this February. They hacked data relating to pre-paid cards and then raised the balance limits, before sending the data to cells around the world that cloned the cards and used them fraudulently (with PINs) to withdraw cash from ATMs.

Cyber-crooks steal millions from ATMs using prepaid debit cards in several countries simultaneously

According to Brian Krebs organised cyber criminals stole almost $11 million in two highly coordinated ATM heists in the final days of 2012. They used re-loadable prepaid debit cards and apparently were able to increase or eliminate the daily withdrawal limits for the prepaid accounts they controlled.  The fact that the attackers were able to do this means they had access to the internal systems of a prepaid card network.

Russian hacker admits guilt for RBS Worldpay $9.4 million loss....

In 2008 an international gang carried out an attack that involved fraudulent cash withdrawals from around 2,100 ATMs in 280 cities across the world in less than 12 hours.  Some of the countries affected were Russia, the Ukraine, USA, Canada, Estonia, Italy, Hong Kong and Japan.

This was possible because of a cyber attack on the computer systems of RBS Worldpay (which was sold by Royal Bank of Scotland last year).  The cyber attack compromised the encryption used by the Worldpay processor to protect customer data on payroll debit cards.  This allowed the hackers to increase the account limits on 44 counterfeit payroll debit cards which were then quickly used for cash withdrawal by the gang's contacts at the ATMs across the world.  Around $9.4 million was taken during the 12 hour period.

Yevgeny Anikin who was part of the international hacking operation, pleaded guilty in a Russian Court and was given a five year suspended sentence.  According to RIA News he said "I want to say that I repent and fully admit my guilt".  He also claims to have started to repay some of the amount stolen.  He has been under house arrest since 2009 and has used some of the stolen money to buy two apartments and a luxury car.

According to Finextra (http://www.finextra.com/news/fullstory.aspx?newsitemid=22247) a leading member of the gang, Viktor Pleshchuk, got off with a suspended six year sentence from a Russian Court. 

His fellow ringleader, Estonian Sergei Tsurikov has been less fortunate; he was extradited to the US to face charges which, if found guilty could see him jailed for up to 35 years.

Russian hacker avoids jail over $10 million cyber theft

09:29 08/02/2011 A Russian man was given a five-year suspended sentence on Tuesday for stealing $10 million from a former division of the Royal Bank of Scotland.>>

Other news of the day