Modernizing Authentication — What It Takes to Transform Secure Access
The U.S. Attorney's Office for the Eastern District of New York today announced that eight defendants have been charged with conspiracy to commit access device fraud, money laundering conspiracy and money laundering, in connection with cyber attacks across 26 countries that caused a total of $45 million in losses.
The defendants allegedly were the New York-based members of an international group that hacked into financial institutions, stole prepaid debit card data, and eliminated withdrawal limits before making fraudulent ATM withdrawals.
In New York alone, according to the indictment, the eight withdrew approximately $400,000 at 140 different ATMs in the course of two hours and 25 minutes on December 22, 2012 -- and on February 19 and 20, 2013, they allegedly withdrew approximately $2.4 million from almost 3,000 ATMs in the New York City area.
Seven of the eight defendants -- Jael Mejia Collado, Joan Luis Minier Lara, Evan Jose Pena, Jose Familia Reyes, Elvis Rafael Rodriguez, Emir Yasser Yeje, and Chung Yu-Holguin -- have been arrested. The eighth defendant, Alberto Yusi Lajud-Pena, who was allegedly the leader of the New York cell, was murdered on April 27, 2013 in the Dominican Republic.
"As charged in the indictment, the defendants and their co-conspirators participated in a massive 21st century bank heist that reached across the Internet and stretched around the globe. In the place of guns and masks, this cybercrime organization used laptops and the Internet," U.S. Attorney Loretta E. Lynch said in a statement. "Moving as swiftly as data over the Internet, the organization worked its way from the computer systems of international corporations to the streets of New York City, with the defendants fanning out across Manhattan to steal millions of dollars from hundreds of ATMs in a matter of hours."
If convicted, the defendants face up to 10 years in prison for each of the money laundering charges and 7.5 years on the conspiracy to commit access device fraud charge, along with restitution and up to $250,000 in fines.