Eight men charged over £5.4m bank theft

Published:

PROSECUTORS have charged eight alleged members of an Eastern European hacking ring with stealing $9million (£5.4million) from customers of a US subsidiary of the Royal Bank of Scotland.

It is claimed the gang cracked a computer system at American payment processing firm RBS WorldPay, cloning cards and raising account limits before withdrawing cash from ATMs across the world.

More than 2,100 machines in at least 280 cities were targeted in what authorities described as “perhaps the most sophisticated and organised computer fraud attack ever conducted”.

The alleged crime was carried out last November, with RBS WorldPay announcing the breach of security the following month.

The US Department of Justice announced the charges yesterday. It said prosecutors in Atlanta, Georgia, had charged Estonian Sergei Tsurikov, 25, Russian Viktor Pleshchuk, 28, Oleg Covelin, 28, of Moldova, and a fourth person known as “Hacker 3” with 16 counts of conspiracy, fraud and identity theft.

Encryption

Igor Grudijev, 31, Ronald Tsoi, 31, Evelin Tsoi, 20, and Mihhail Jevgenov, 33, all from Tallinn, Estonia, have also been charged with access-device fraud.

It is alleged the group used sophisticated hacking techniques to break RBS WorldPay’s data encryption system used to protect customer details on payroll debit cards.

Once cloned, the gang raised the account limits of customers and set up a network of “cashers” to steal money from machines around the world, it is alleged. In under 12 hours, RBS WorldPay lost the $9million as a result of the crime, prosecutors said.

The “cashers” were allowed to keep between 30% to 50% of the stolen funds, with the rest being wired back to the criminal gang, it is alleged.

Sally Quillian Yates, acting US attorney of the Northern District of Georgia, said: “This investigation has broken the back of one of the most sophisticated computer hacking rings in the world.”

She praised RBS WorldPay for immediately reporting the crime once detected.