[ISN] Three Plead Guilty in $2 Million Citibank ATM Caper

From: InfoSec News <alerts_at_private>
Date: Thu, 6 Nov 2008 06:01:40 -0600 (CST)

By Kevin Poulsen 
Threat Level
November 05, 2008

Three New Yorkers accused of using hacked Citibank ATM card numbers and 
PINs to steal $2 million from customer accounts in four months have 
pleaded guilty to federal conspiracy and access device fraud charges.

The defendants -- Ivan Biltse, Angelina Kitaeva and Yuriy Rakushchynets, 
aka Yuriy Ryabinin -- are among 10 suspects charged earlier this year in 
connection with a breach of a server that processes ATM transactions 
from 7-Eleven convenience stores. Those ATMs are branded Citibank, but 
they're owned by Houston-based Cardtronics.

Court records indicate a Russian hacker cracked the ATM server in late 
2007, and monitored transactions from 7-Eleven cash machines long enough 
to capture thousands of account numbers and PINs. The Russian then 
farmed out the stolen data to mules in the United States, who burned the 
account numbers onto blank mag-stripe cards and withdrew cash from 
Citibank ATMs in the New York area for at least five months, sending 70 
percent of the take back to Russia.

Citibank reported the breach to the FBI in February.  In a separate 
investigation, U.S. Secret Service agents had already identified 
Rakushchynets as a member of the computer underground, and they tied him 
to the Citibank heist after comparing ATM surveillance photos to 
pictures of Rakushchynets posted on ham radio websites.

In January, two other alleged cashers -- Nue Quni and Luma Bitti -- were 
arrested after a lucky traffic stop caught them with blank cards and a 
mag-stripe writer in their car. Bitti cooperated in the investigation 
and led the FBI to two more suspects, Andrey Baranets and Aleksandr 
Desevoh, who were arrested in New York after meeting with -- and 
attempting to mug -- an undercover FBI agent.


Visit the InfoSec News Security Bookstore
Best Selling Security Books and More!
Received on Thu Nov 06 2008 - 04:01:40 PST

This archive was generated by hypermail 2.2.0 : Thu Nov 06 2008 - 04:07:09 PST