Authorities have arrested several cyberthieves who participated in an operation that netted $45 million from ATMs around the world in two operations, one in December of 2012 and one in February. Several were arrested on Thursday, with German officials saying they arrested two Dutch suspects on Friday.
On Thursday, U.S. authorities said they had arrested seven members of what they said comprised the operation’s New York cell. They are accused of stealing $2.8 million from area ATMs, and are accused of working with hackers who twice broke into credit card processing companies’ computer systems. An eighth suspect, allegedly the ringleader of the New York Cell, Alberto Lajud-Pena, was found murdered in the Dominican Republic on April 27.
United States Attorney Loretta E. Lynch said, in a statement:
As charged in the indictment, the defendants and their co-conspirators participated in a massive 21st century bank heist that reached across the Internet and stretched around the globe.
In the place of guns and masks, this cybercrime organization used laptops and the Internet. Moving as swiftly as data over the Internet, the organization worked its way from the computer systems of international corporations to the streets of New York City, with the defendants fanning out across Manhattan to steal millions of dollars from hundreds of ATMs in a matter of hours.
Using what is known as an “unlimited operation” technique, the hackers allegedly increased the available balance and withdrawal limits on prepaid MasterCard debit cards issued by the National Bank of Ras Al Khaimah PSC (RAKBANK) of the United Arab Emirates and the Bank of Muscat of Oman.
They then manufactured counterfeit debit cards enabling “cashers” around the globe to withdraw millions of dollars from ATM machines in a matter of hours.
Authorities assert that the New York cell withdrew their share of the cash on two separate occasions, once in December and again in February.
The New York suspects have been charged with conspiracy to commit access device fraud, money laundering conspiracy and money laundering. If found guilty, the defendants each face up to 10 years behind bars for money laundering and another seven-and-a-half years for each of the other three charges.
The two Dutch suspects, a 35-year-old man and a 56-year-old woman, were actually caught on Feb. 19, although the arrests were not announced until after U.S. authorities clamped down on Thursday. The pair had come to Düsseldorf with the purpose of withdrawing money in Germany. They are accused of computer fraud and faking credit cards.
Although arrests have been made, it appears that authorities have only lopped off the arms of the operation, not the head. There are few details about the people responsible for the hacking or who might be leading the global operation.