Four charged with hacking point-of-sale computers
Romanian hackers targeted Subway restaurants and other U.S. retailers, the DOJ says
IDG News Service - Four residents of Romania have been charged for their alleged participation in a multimillion-dollar scheme to remotely access point-of-sale systems at more than 150 Subway restaurants and other U.S. merchants and steal payment card data, the U.S. Department of Justice said.
The four-count indictment, unsealed Wednesday, charges the four Romanians with conspiracy to commit computer fraud, wire fraud and access device fraud. Charged in U.S. District Court for the District of New Hampshire were Adrian-Tiberiu Oprea, 27, of Constanta, Romania; Iulian Dolan, 27, of Craiova; Cezar Iulian Butu, 26, of Ploiesti; and Florin Radu, 23, of Rimnicu Vilcea.
Oprea was arrested last week in Romania and is in custody there, the DOJ said in a press release. Dolan and Butu were arrested upon their entry into the U.S. in August 2011 and remain in custody. Radu remains at large.
From 2008 until May 2011, Oprea, Dolan, Butu and Radu conspired to remotely hack into more than 200 U.S.-based merchants' point-of-sale (POS) or "checkout" computer systems in order to steal customers' credit, debit and gift card numbers and related data, the DOJ alleged. Compromised Subway restaurant systems were in New Hampshire, New York, California and elsewhere, according to the indictment.
A POS system allows merchants to process customer purchases and typically includes a computer, monitor, credit-card processing system, signature capture device and a customer pin pad device. Merchant victims include more than 150 Subway restaurant franchises in the U.S. and 50 other retailers. The four compromised the payment card data of more than 80,000 customers and made millions of dollars worth of unauthorized purchases, the DOJ said.
The defendants remotely scanned for vulnerable POS systems with remote desktop software installed, according to the indictment. They logged into the computers either by guessing the passwords or using password-cracking programs, the indictment said.
The four then installed keystroke loggers onto the POS systems, and they often installed back door Trojans onto the POS systems to allow them to access the systems in the future in order to install or re-install malware, the indictment said.
The defendants each face a maximum of five years in prison for each count of conspiracy to commit computer related fraud, 30 years in prison for each count of conspiracy to commit wire fraud, and five years in prison for each count of conspiracy to commit access device fraud. They also face fines up to twice the amount of the fraud loss and restitution, the DOJ said.
Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's e-mail address is firstname.lastname@example.org.
- Transforming Information Security: Future-Proofing Processes This report provides a valuable set of recommendations from 19 of the world'd leading security officers to help organizations build security strategies for...
- The Evolution of Corporate Cyberthreats Cybercriminals are creating and deploying new threats every day that are more destructive than ever before. While you may have more people devoted...
- 3 Questions to Ask Your DNS Host about Lowering DDoS Risks Neustar has had wide-ranging conversations with clients wanting to know how they can optimize protection as DDoS attacks increase in frequency and size.
- The Danger Deepens: 2014 Neustar Annual DDoS Attacks and Impact Report This report compares DDoS findings from 2013 to 2012, based on a survey of 440 North American companies, including 139 businesses delivering technology...
- Establish Cyber Resiliency: Developing a Continuous Response Architecture Many enterprises fail to proactively prepare the battlefield for a data breach by only leveraging outdated techniques that focus on the perimeter or...
- An Incident Response Playbook: From Monitoring to Operations As cyber-attacks grow more sophisticated, many organizations are investing more into incident detection and response capabilities. In this webcast, learn how to develop... All Cybercrime and Hacking White Papers | Webcasts