8,500 victims in international data theft

IDG News Service - British electronic-crime detectives are investigating a massive data theft operation that stole sensitive information from 8,500 people in the U.K. and others in some 60 countries, officials said Tuesday.

In total, cybercriminals targeted 600 financial companies and banks, according to U.K. authorities, who have worked over the past week to identify and notify victims.

Through intelligence sources, U.K. police were given several gigabytes of data -- around 130,00 files -- that came from a server in the U.S., said Charlie McMurdie, detective chief inspector for the Specialist Crime Directorate e-Crime Unit of the London Metropolitan Police. Most of the data related to financial information, she said.

The data was collected by a malicious software program nicknamed Haxdoor that infected victims' computers. Some 2,300 machines were located in the U.K. McMurdie said.

Haxdoor is a powerful program that can collect passwords and send them to another e-mail address plus disable a computer's firewall, among other functions, according to a description posted on security vendor F-Secure Corp.'s Web site. Symantec Corp., another security company, wrote it first detected Haxdoor in November 2003.

Computers can get infected with Haxdoor if they don't have security patches or up-to-date antivirus software. London police said it's believed many victims were infected through instant message programs.

Programs such as Haxdoor are often sent in spam messages as attachments, and if opened, infect the computers without the user's knowledge. The programs can also be distributed through unsolicited instant message links.

Metropolitan police experts built a special program to search through the data and identify victims, she said. The data contained information such as logins and passwords for major Web sites such as eBay Inc., Amazon.com, BT Group PLC and Pipex Internet Ltd., a U.K. Internet service provider.

In some instances, Haxdoor employed a screen-capture function to obtain information, McMurdie said.

Over the last week, the unit has contacted U.K. banks and other financial institutions to notify them what account numbers were compromised so those institutions could contact their customers, she said. But the data also showed information collected from computers in the U.S.,  Germany, France, Italy and Spain, but the number of victims is not known, she said.

The unit is working with Interpol, the international police organization, to find trace those who were collecting the data. "This is a significant theft of data from the U.K. and globally," McMurdie said.