[ISN] Feds take over municipal court Web-hacking probe

From: InfoSec News (alerts@private)
Date: Thu Dec 20 2007 - 23:19:44 PST


By Bruce Cadwallader
The Columbus Dispatch
December 20, 2007

At least six central Ohioans are now under investigation by the U.S. 
Secret Service for hacking into a government Web site and stealing 
Social Security numbers to create false credit accounts.

Worthington detectives turned over evidence to federal authorities after 
a state crime lab determined that more than 270 people nationwide might 
have been victimized by a security lapse in the Franklin County 
Municipal Court Web site.

Police found that someone was randomly feeding Social Security numbers 
into Clerk Lori Tyack's site, which contained personal information for 
thousands of people charged with misdemeanors, some guilty of only a 
speeding ticket. Once a number was hit on, the name, address, age and 
other information could be used to obtain credit cards and open bank 

The victims are from Ohio, South Carolina, Kentucky, Texas and Wyoming, 
said Worthington detective Ted Paxton. Many might not know that their 
identities have been stolen.

The case was turned over to the Secret Service because it investigates 
misuse of the Internet for identity theft and because the case had 
broadened to include so many potential victims, Paxton said.

That would have been a career case for just one of our detectives, so we 
asked for help from federal authorities, said Sgt. John Slaughter. The 
Secret Service will take the case to the assistant U.S. attorney's 
office. We now have six suspects.

A Secret Service spokesman contacted Wednesday said the agency would 
have no comment on the investigation.

No one has been arrested yet. Worthington police seized the records and 
computers of two people, who implicated others, Slaughter said.

One suspect told detectives how the scam worked. She told them she also 
had access to federal tax returns as a former seasonal tax preparer for 
an H&R Block office that is now closed.

The investigation began after a 22-year-old Worthington woman reported 
unauthorized purchases on her credit cards. Police found that 
merchandise was sent to an address other than hers. When they went to 
that address, they found receipts and banking information in the names 
of 72 people, and a laptop that included 200 more names.

Paxton said he has identified more than $40,000 in illegal purchases of 
clothing, shoes, phones and electronics.

The thieves were using a laptop stolen from Wyoming, but they only had 
it for a couple weeks, Paxton said. You can actually see where they went 
from (Tyack's) Web site to Equifax (a credit bureau) and then on to 
credit-card companies and banks.

The Ohio Bureau of Criminal Identification and Investigation did a 
forensic evaluation of computer files and uncovered the names of 
potential victims. Worthington police didn't have the officers to locate 
them all, Slaughter said.

Tyack said she was aware of the federal investigation but not involved 
in it. In July, she limited the information available on the Web site.

The Municipal Court site has permitted public searches of court records 
since 2001 and generates more than 16,000 hits per day, Tyack said.

Officials said they will try to locate anyone affected by the thefts, 
but individuals can also take steps to protect their own credit by 
verifying information on free credit reports and keeping constant 
vigilance over their accounts.

Visit InfoSec News

This archive was generated by hypermail 2.1.3 : Thu Dec 20 2007 - 23:41:57 PST