Elaborate Scheme Stole over $9.4 Million from Credit Card Processor

Victor Pleshchuk, 28, of St. Petersburg, Russia; Sergei Tsurikov, 25, of Tallinn, Estonia; and Oleg Covlien, 28, of Chişinău, Moldova, along with an unidentified individual, have been indicted by a federal grand jury on charges of conspiracy to commit wire fraud, wire fraud, conspiracy to commit computer fraud, computer fraud, and aggravated identity theft.

Acting United States Attorney Sally Quillian Yates said of the case, “Last November, in just one day, an American credit card processor was hacked in perhaps the most sophisticated and organized computer fraud attack ever conducted. Today, almost exactly one year later, the leaders of this attack have been charged. This investigation has broken the back of one of the most sophisticated computer hacking rings in the world. This success would not have been possible without the efforts of the victim, and unprecedented cooperation from various law enforcement agencies worldwide.”

In Washington, D.C., Assistant Attorney General of the Criminal Division Lanny A. Breuer said, “The charges brought against this highly sophisticated international hacking ring were possible only because of unprecedented international cooperation with our law enforcement partners, particularly between the United States and Estonia. Through our close cooperation, both nations have demonstrated our commitment to identifying sophisticated attacks on U.S. financial networks that are directed and operated from overseas and our commitment to bringing the perpetrators to justice.”

FBI Atlanta Special Agent in Charge Greg Jones said, “Through the diligent efforts of the victim company and multiple law enforcement agencies within the United States and around the world, the leaders of a technically advanced computer hacking group were identified and indicted in Atlanta, sending a clear message to cyber-criminals across the globe. Justice will not stop at international borders but continue with the on-going cooperation between the FBI and other agencies such as the Estonian Central Criminal Police and the Netherlands Police Agency.”

According to Acting United States Attorney Yates, the charges and other information presented in court: During November, 2008, Pleshchuk, Tsurikov and Covelin allegedly obtained unauthorized access into the computer network of “RBS WorldPay,” the U.S. payment processing division of the Royal Bank of Scotland Group PLC, located in Atlanta. The indictment alleges that the group used sophisticated hacking techniques to compromise the data encryption that was used by RBS WorldPay to protect customer data on payroll debit cards. Payroll debit cards are used by various companies to pay their employees. By using a payroll debit card, employees are able to withdraw their regular salaries from an ATM.

Once the encryption on the card processing system was compromised, the hacking ring allegedly raised the account limits on compromised accounts, and then provided a network of “cashers” with 44 counterfeit payroll debit cards, which were used to withdraw more than $9 million from over 2,100 ATMs in at least 280 cities worldwide, including cities in the United States, Russia, Ukraine, Estonia, Italy, Hong Kong, Japan and Canada. The $9 million loss occurred within a span of less than 12 hours.

The hackers then allegedly sought to destroy data stored on the card processing network in order to conceal their hacking activity. The indictment alleges that the “cashers” were allowed to keep 30 to 50 percent of the stolen funds, but transmitted the bulk of those funds back to Tsurikov, Pleshchuk and other co-defendants, using means such as WebMoney accounts and Western Union. Upon discovering the unauthorized activity, RBS WorldPay immediately reported the breach, and has substantially assisted in the investigation.

Throughout the duration of the cashout, Pleshchuk and Tsurikov allegedly monitored the fraudulent ATM withdrawals in real-time from within the computer systems of RBS WorldPay. Once the withdrawals were completed, They allegedly attempted to conceal their activities in the RBS WorldPay computer network by destroying and attempting to destroy data.

The indictment charges sixteen counts including wire fraud and conspiracy to commit wire fraud, computter fraud and conspiracy to commit computer fraud, aggravated identity theft and access device fraud.

The indictment seeks forfeiture of over $9.4 million of proceeds of the crimes from the defendants.

This case is being investigated by Special Agents of the Federal Bureau of Investigation. Assistance was provided by international law enforcement partners. The United States Secret Service also participated in the investigation. RBS World Pay immediately reported the crime and has substantially assisted in the investigation.

Assistant United States Attorneys Lawrence R. Sommerfeld and Gerald Sachs, and Senior Counsel Kimberly Kiefer Peretti of the Computer Crime and Intellectual Property Section of the U.S. Department of Justice are prosecuting the case. Office of International Affairs counsel Deborah Gaynus is assisting with extradition matters. Treaty assistance was provided by Office of International Affairs counsels Betsy Burke, Blair Berman, Roman Chaban, Judith Friedman, Deborah Gaynus, Linda McKinney, and Mary McLaren.

For further information please contact Sally Q. Yates, Acting United States Attorney, or Charysse L. Alexander, Executive Assistant United States Attorney, through Patrick Crosby, Public Affairs Officer, U.S. Attorney's Office, at (404) 581-6016. The Internet address for the HomePage for the U.S. Attorney's Office for the Northern District of Georgia is www.usdoj.gov/usao/gan.