A US federal grand jury has indicted four hackers for allegedly breaking into a computer network operated by the Atlanta-based credit card processing company RBS WorldPay.
The 16-count indictment charges Sergei Tsurikov (Estonia), Viktor Pleshchuk (Russia), Oleg Covelin (Moldova) and "Hacker 3" with conspiracy to commit wire fraud, computer fraud, access device fraud and aggravated identity theft.
According to the US Department of Justice (DoJ), the international ring used "sophisticated" hacking techniques to compromise the data encryption deployed by RBS WorldPay to protect customer data on payroll debit cards.
"Once the encryption on the card processing system was compromised, the hacking ring allegedly raised the account limits on compromised accounts, and then provided a network of 'cashers' with 44 counterfeit payroll debit cards," the DoJ explained in an official statement. "[The cards] were [then] used to withdraw more than $9 million from more than 2,100 ATMs in at least 280 cities worldwide, including cities in the United States, Russia, Ukraine, Estonia, Italy, Hong Kong, Japan and Canada. The $9 million loss occurred within a span of less than 12 hours."
The "cashers" were reportedly permitted to keep 30 to 50 percent of the stolen money, but transmitted the majority of the funds back to Tsurikov, Pleshchuk and other co-defendants.
The four hackers face 20 year prison sentences for conspiracy to commit wire fraud (per count), up to five or 10 years for each count of computer fraud, two-years for aggravated identity theft and $3.5 million in fines.