Four hackers indicted in RBS WorldPay breach

By SearchFinancialSecurity.com Staff 10 Nov 2009 | SearchFinancialSecurity.com

Security UK News Digg This!     StumbleUpon     Del.icio.us

Four people who allegedly hacked into payment processor RBS WorldPay and helped steal more than $9 million from ATMs in a highly coordinated attack last year were indicted, authorities announced Tuesday.

Sergei Tsurikov, 25, of Tallinn, Estonia, Viktor Pleshchuk, 28, of St. Petersburg, Russia, Oleg Covelin, 28, of Chisinau, Moldova, and a person known only as "Hacker 3" were indicted by a federal grand jury in Atlanta, Ga., the U.S. Department of Justice said.

The 16-page indictment alleges the group used sophisticated hacking techniques to compromise the data encryption used by Atlanta-based RBS WorldPay to secure payroll debit cards, which some companies use to pay their employees.

The group then allegedly raised the account limits on compromised accounts and gave 44 counterfeit payroll debit cards to a network of "cashers," who used the cards to drain more than $9 million from more than 2,100 ATMs in 280 cities around the world in less than 12 hours, according to prosecutors.

Four others, all from Estonia, were indicted for access device fraud in the case.

"Last November, in just one day, an American credit card processor was hacked in perhaps the most sophisticated and organized computer fraud attack ever conducted. Today, almost exactly one year later, the leaders of this attack have been charged," Acting U.S. Attorney Sally Quillian Yates of the Northern District of Georgia said in a prepared statement. "This investigation has broken the back of one of the most sophisticated computer hacking rings in the world."

RBS WorldPay, the U.S. payment processing arm of the Royal Bank of Scotland, reported last December that personal information of about 1.5 million pre-paid cardholders and other individuals was compromised when its computer system was hacked.

Prosecutors credited RBS WorldPay and cooperation with multiple law enforcement agencies worldwide in the investigation.

Tags: Data Breach Incident Management and Recovery,  Data Protection Solutions and Strategy,  VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Data Breach Incident Management and Recovery Make PCI DSS compliance easier by reducing scope, outsourcing data Full disk encryption: Safer and easier than file and folder encryption PCI DSS requirements: Get ready for stricter enforcement, fines Data breach costs continue to rise in 2009, Ponemon study finds Data Protection Act breach could cost companies 500,000 pounds Jericho Forum to provide customers with good security questions to ask Verizon report goes deep inside data breach investigations Insider threat detection still a challenge for employers Layoffs prompt insider threat fears, cybersecurity survey finds ArcSight boosts system log management capabilities Data Protection Solutions and Strategy Enterprise data management: Prevent data loss and insider threats NSA, cryptoexperts jab at RSA Conference 2010 Cryptographers' Panel Make PCI DSS compliance easier by reducing scope, outsourcing data Data Protection Act fines likely limited, audit powers may expand Websense integrated security system aims to simplify security management Full disk encryption: Safer and easier than file and folder encryption No major PCI DSS revision expected in 2010 Data breach costs continue to rise in 2009, Ponemon study finds Chinese hacker attacks target Google Gmail accounts, top tech firms Annual security reports offer some hope

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary UK Identity Cards Act  (SearchSecurityUK.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary