Cyber thieves around the world stole $45 million by hacking into debit card companies, scrapping withdrawal limits and helping themselves from cash machines, US authorities said Thursday.
The massive heist unfolded “in a matter of hours,” said the US prosecutor’s office for Brooklyn, New York.
Prosecutors unveiled charges against eight people accused of forming the New York cell of the plot, which stretched across 26 countries. In their case, they allegedly lifted $2.8 million in cash and now face charges of conspiracy to commit access device fraud and money laundering.
Seven of the eight have been arrested, the US attorney’s office said. The eighth, Alberto Yusi Lajud-Pena, who was the leader and was nicknamed “Prime” and “Albertico,” is reported to have been murdered two weeks ago, the office said.
“The defendants and their co-conspirators participated in a massive 21st century bank heist that reached across the Internet and stretched around the globe,” US Attorney Loretta Lynch said in a statement.
“In the place of guns and masks, this cybercrime organization used laptops and the Internet.”
The type of heist is known to criminals as an “unlimited operation” and two were allegedly carried out: first on December 22 last year and again on February 19-20 this year.
In the initial stage, taking several months, sophisticated hackers allegedly infiltrated credit card processors’ computer networks, looking into databases of prepaid debit cards, a tool used often by employers and aid organizations.
Breaking into the system, the hackers eliminated withdrawal limits imposed by banks.
Next, the hackers cybergang distributed the debit card numbers to its street associates called “cashers,” who loaded other magnetic stripe cards, like gift cards, with the stolen data.
Finally, the cashers were given stolen PIN numbers and sent to harvest the loot, going from ATM to ATM and withdrawing as much as cash as they could for the organization.
In the first alleged raid, hackers targeted RAKABANK in the United Arab Emirates. After manipulating the withdrawal limits, casher gangs worldwide hit the ATMs, conducting some 4,500 transactions worth $5 million across about 20 countries.
In the second attack, US prosecutors say, the group broke into the Bank of Muscat based in Oman. Then in the space of 10 hours, casher cells in 24 countries conducted some 36,000 transactions, withdrawing $40 million from ATMs.
The New York cell, the US attorney’s office says, took $400,000 in the first raid and $2.4 million on the second, when it made some 3,000 ATM withdrawals.
The prosecutor’s office highlighted the “surgical precision” of the alleged plot and “the speed and coordination with which the organization executes its operations on the ground. These attacks rely upon both highly sophisticated hackers and organized criminal cells whose role is to withdraw the cash as quickly as possible.”
According to the indictment of the New York defendants, they quickly moved to launder their cash, opening a Miami bank account and pouring money into cars, including a Porsche and a Mercedes, and two Rolex watches. There was no detail given on the apparent murder of their leader just over two months after the second alleged heist.
Nor did prosecutors give details of where else the alleged criminal operations unfolded abroad.
However, they gave some idea of the scope of the alleged crime by thanking authorities from more than a dozen countries: Belgium, Britain, Canada, the Dominican Republic, Estonia, France, Germany, Italy, Japan, Latvia, Malaysia, Mexico, Romania, Spain, Thailand, and the United Arab Emirates.
Updated: 05/10/13 10:15AM with additional content.
