Restaurant chain served up payment card data to hackers

Computerworld - In the third data theft incident of its kind to come to light since March, Dallas-based restaurant chain Dave & Buster's Inc. today disclosed that credit and debit card numbers were stolen last year from the computer systems at 11 of its locations during the card verification process.

The thefts at Dave & Buster's took place during a four-month period from May through August of last year and have resulted in fraudulent payment card transactions worth at least $600,000 using data stolen from one of the restaurants alone, according to a federal grand jury indictment of three individuals that was unsealed yesterday at U.S. District Court in Central Islip, N.Y.

The U.S. Department of Justice said in a statement (download PDF) that the three alleged perpetrators — two of whom are listed as living in Eastern Europe — have all been arrested in connection with the case and that they are charged with various crimes as part of the indictment.

The DOJ identified the arrested individuals as Maksym Yastremskiy, a resident of Ukraine, and Aleksandr Suvorov, of Estonia. The 27-count indictment against the two includes charges of computer fraud, wire fraud, aggravated identity theft and interception of electronic communications.

Yastremskiy, who also goes by the name Maksik, was arrested last July in Turkey, the DOJ said, adding that the U.S. government has made a formal request to have him extradited. Suvorov, who uses the online handle JohnnyHell, was arrested in March in Germany at the request of U.S. officials and remains in jail there while the German government acts on a formal extradition request, the DOJ said.

The third individual charged in the Dave & Buster's case was identified as Albert Gonzalez, a Miami resident who faces one count of wire fraud. The DOJ said that Gonzalez, who uses the alias Segvec, was arrested this month by the U.S. Secret Service.

In a statement sent via e-mail in response to a request for comment, Dave & Buster's said that the alleged thieves stole the so-called Track 2 data from the magnetic stripes on the back of credit and debit cards, including the card numbers and expiration dates. The company said that the information hadn't been stored on its systems and was taken while the data was being transmitted to authorize transactions. It noted that the thieves didn't get any other personal data, such as names, addresses, PINs, or bank account and Social Security numbers.

In the statement, which was posted on the Restaurant News Resource Web site, Dave & Buster's said that it "was alerted to the potential data intrusion" late last August and that it "immediately" notified Secret Service officials. The company added that it notified the credit card companies of affected cardholders last September. But the data thefts weren't publicly disclosed until after the unsealing of the grand jury indictment.