http://www.straitstimes.com/Free/Sto...ry_265313.html
Aug 7, 2008
40 million card numbers stolen
US cracks biggest identity theft case; 11 people from five countries charged
BOSTON - THE US federal authorities say they have cracked the largest-ever case of identity theft, in which 40 million credit and debit card numbers and tens of millions of dollars were stolen.
The three-year investigation by federal agencies and overseas allies, which culminated in 11 people being charged on Tuesday, also brought home the global nature of the Internet's underground economy.
The scam targeted US companies, including clothes retailer TJ Maxx and bookseller Barnes & Noble, hacking into their databases to steal customers' details.
But the ring operated mainly in Eastern Europe, the Philippines, China and Thailand, and while three of those charged are US citizens, others are from places such as Estonia, Ukraine, Belarus and China.
The full scope of the damage may never be learned, but the United States Justice Department said the fraud reached at least into the tens of millions of dollars, and many potential victims have yet to be contacted.
'So far as we know, this is the single largest and most complex identity theft case ever charged in this country,' US Attorney-General Michael Mukasey said at a news conference in Boston, where he announced indictments.
TJX Companies, which owns TJ Maxx and Marshalls, another of the affected stores, discovered the security breach in its system in late 2006 and announced it early last year.
Another of the targets, shoe retailer DSW, discovered the breach in 2005.
But some other companies were not even aware that hackers had broken into their databases until Tuesday.
Barnes & Noble 'had not received inquiries from credit card companies or customers about these alleged activities', the company said.
The break in the case came when a handful of people were arrested in Florida last year, not long after TJ Maxx revealed that it had been hacked. They were caught trying to use fake credit cards to buy goods at Wal-Mart.
Some began cooperating, and the trail led to members-only websites as well as to Internet chats and Web transactions in the millions of dollars.
Two Chinese nationals - who are among several accused conspirators who remain abroad and at large - were charged with providing the blank cards that were encoded with stolen information.
The bigger suspects include Ukrainian Maksym Yastremskiy, accused of selling credit card numbers for more than US$10 million (S$14 million), and Aleksandr Suvorov of Estonia, who allegedly supplied Yastremskiy with the numbers and related data.
The two were arrested while on holiday in Turkey and Germany, respectively.
But to the chagrin of the US Secret Service, the ringleader of the scam appears to be one of its own informants, Miami resident Albert Gonzalez.
He is accused of double-crossing the agency by tipping off his cohorts to the ongoing investigation, and prosecutors say he could now face life in prison.
How the scam worked
PROSECUTORS say members of the gang drove around and scanned the wireless networks of retailers to find security holes, a technique known as 'war driving'.
Once they had identified technical weaknesses in the networks, they used them to install 'sniffer programs', obtained from collaborators overseas.
Those programs then tapped into the networks the retailers used for processing credit cards and intercepted customers' PIN codes and debit and credit card numbers stored there.
The information was then transmitted to computers in the United States, Latvia and Ukraine.
Officials said that the conspirators sold some of the credit card numbers online and imprinted others on the magnetic strips of blank cards so that they could withdraw thousands of dollars from automated teller machines. 
40 million card numbers stolen 
Linear Mode
