By Jessica Dye, Joseph Ax and Jim Finkle
NEW YORK/BOSTON (Reuters) - In one of the biggest ever bank heists, a global cyber crime ring stole $45 million from two Middle Eastern banks by hacking into their credit card processing firms and withdrawing money from ATMs in 27 countries, U.S. prosecutors said on Thursday.
New York federal prosecutors accused eight men of allegedly forming the New York-based cell of the organization, and said seven of them have been arrested. The eighth defendant was reported to have been murdered in the Dominican Republic on April 27, according to U.S. prosecutors.
He was allegedly a leader of the cell and reported to ringleaders believed to be outside the United States.
"In the place of guns and masks, this cyber crime organization used laptops and the Internet," U.S. Attorney for the Eastern District of New York Loretta Lynch said at a news conference. "Moving as swiftly as data over the Internet, the organization worked its way from the computer systems of international corporations to the streets of New York City."
For a graphic click on https://bsmedia.business-standard.comlink.reuters.com/nuc97t
More From This Section
The case demonstrates the major threat that cyber crime poses to banks around the world. Prosecutors said the international crime ring used an attack known as "Unlimited Operations" in the cyber underworld.
According to the complaint, they used sophisticated hacking techniques to break into the computers of two credit card processors, one in India in December 2012 and the other in the United States this February. The complaint did not identify the companies.
In both cases, the hackers increased the available balance and eliminated the withdrawal limits on prepaid MasterCard debit cards issued by Bank of Muscat of Oman, and National Bank of Ras Al Khaimah PSC (RAKBANK) of the United Arab Emirates.
They then allegedly distributed counterfeit debit cards to the New York cell and other teams around the world - known as "cashers" - enabling them to siphon millions of dollars from ATMs in a matter of hours, according to the complaint.
Cashers pulled some $40 million during the Bank of Muscat operation and stole another $5 million during the RAKBANK operation, prosecutors said. In total, cashers made some 40,500 withdrawals in 27 countries during the two coordinated incidents.
Representatives for the two banks could not be reached for comment outside of regular business hours.
In late February, Bank Muscat disclosed that it would take an impairment charge of up to 15 million rials because it had been defrauded overseas by 12 prepaid debit cards used for travel. That charge was equal to more than half of the 25 million rials profit it posted in its first quarter ended March 31.
HIGHLY SKILLED HACKERS
Cyber experts said they believe the operation likely required the work of several hundred people, at least several of whom were highly skilled hackers capable of devising ways to penetrate well-protected financial systems.
"Hackers only need to find one vulnerability to cause millions of dollars of damage," said Mark Rasch, a former federal cyber crimes prosecutor, based in Bethesda, Maryland.
A single account number, for instance, yielded nearly $9 million in profits, including an alleged $2.4 million from the cell in New York City, prosecutors said.
The eight defendants - all U.S. citizens and residents of Yonkers, New York - were charged with withdrawing cash from the ATMs and transporting money, not hacking into the credit card processing firms or managing the operation.
The seven arrested are: Jael Mejia Collado, Joan Luis Minier Lara, Evan Jose Peña, Jose Familia Reyes, Elvis Rafael Rodriguez, Emir Yasser Yeje and Chung Yu-Holguin (known as "Chino El Abusador"). All except for Rodriguez were arraigned on Thursday and pleaded not guilty. Rodriguez's attorney was unavailable. Only Pena has been released on bail.
The defendant, who reportedly had been killed was Alberto Yusi Lajud-Peña, also known as "Prime" and "Albertico." Lynch said it was unclear whether the murder was related to this case.
Prosecutors said cashers often laundered their proceeds by purchasing luxury goods, and sending a portion of the money back to the organization's leaders. They said they seized hundreds of thousands of dollars in cash and bank accounts, as well as two Rolex watches and a Mercedes SUV, from the New York defendants.
Investigators said that they found an email exchange with an account associated with a criminal money laundering operation in St. Petersburg, Russia, describing wire transfers.
An investigation is ongoing to see if other cells are operating in the country, Lynch said, adding that U.S. law enforcement had worked with counterparts in Japan, Canada, Germany, Romania, the United Arab Emirates, Dominican Republic, Mexico, Italy, Spain, Belgium, France, United Kingdom, Latvia, Estonia, Thailand, and Malaysia to uncover the ring.
No individual bank accounts were compromised by the scheme, Lynch said. (Editing by Noeleen Walder, Tiffany Wu and Leslie Gevirtz)