Four charged with hacking point-of-sale computers
Romanian hackers targeted Subway restaurants and other U.S. retailers, the DOJ says
IDG News Service - Four residents of Romania have been charged for their alleged participation in a multimillion-dollar scheme to remotely access point-of-sale systems at more than 150 Subway restaurants and other U.S. merchants and steal payment card data, the U.S. Department of Justice said.
The four-count indictment, unsealed Wednesday, charges the four Romanians with conspiracy to commit computer fraud, wire fraud and access device fraud. Charged in U.S. District Court for the District of New Hampshire were Adrian-Tiberiu Oprea, 27, of Constanta, Romania; Iulian Dolan, 27, of Craiova; Cezar Iulian Butu, 26, of Ploiesti; and Florin Radu, 23, of Rimnicu Vilcea.
Oprea was arrested last week in Romania and is in custody there, the DOJ said in a press release. Dolan and Butu were arrested upon their entry into the U.S. in August 2011 and remain in custody. Radu remains at large.
From 2008 until May 2011, Oprea, Dolan, Butu and Radu conspired to remotely hack into more than 200 U.S.-based merchants' point-of-sale (POS) or "checkout" computer systems in order to steal customers' credit, debit and gift card numbers and related data, the DOJ alleged. Compromised Subway restaurant systems were in New Hampshire, New York, California and elsewhere, according to the indictment.
A POS system allows merchants to process customer purchases and typically includes a computer, monitor, credit-card processing system, signature capture device and a customer pin pad device. Merchant victims include more than 150 Subway restaurant franchises in the U.S. and 50 other retailers. The four compromised the payment card data of more than 80,000 customers and made millions of dollars worth of unauthorized purchases, the DOJ said.
The defendants remotely scanned for vulnerable POS systems with remote desktop software installed, according to the indictment. They logged into the computers either by guessing the passwords or using password-cracking programs, the indictment said.
The four then installed keystroke loggers onto the POS systems, and they often installed back door Trojans onto the POS systems to allow them to access the systems in the future in order to install or re-install malware, the indictment said.
The defendants each face a maximum of five years in prison for each count of conspiracy to commit computer related fraud, 30 years in prison for each count of conspiracy to commit wire fraud, and five years in prison for each count of conspiracy to commit access device fraud. They also face fines up to twice the amount of the fraud loss and restitution, the DOJ said.
Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's e-mail address is email@example.com.
- Gartner Magic Quadrant for Client Management Tools The client management tool market is maturing and evolving to adapt to consumerization, desktop virtualization, and an ongoing need to improve efficiency.
- Audit Ready and Asset Optimized: The Solid Promise of an Intelligent Software Asset Management Solution In this paper Frost & Sullivan examines the benefits of enterprise-grade Software Asset Management solutions, and how these solutions serve as the convergence...
- Pragmatic Endpoint Management: Empowering an SMB Workforce in the Age of Mobility Lacking the time for proper training and education, SMB administrators often resort to taking shortcuts to keep their environment running.This paper discusses the...
- Gartner Magic Quadrant for Application Security The market for application security testing is changing rapidly. Technology trends, such as mobile applications, advanced Web applications and dynamic languages, are forcing...
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Cybercrime and Hacking White Papers | Webcasts