U.S. Indicts 11 in Largest U.S. Identity Theft Case

Roo · Aug 5th, 2008, 08:15 PM

http://www.bloomberg.com/apps/news?p...v8&refer=home#

U.S. Indicts 11 in Largest U.S. Identity Theft Case (Update2)

By Andrew Harris and Heather Burke

Aug. 5 (Bloomberg) -- The Justice Department charged 11 people with stealing more than 40 million credit- and debit-card numbers from nine retailers including T.J. Maxx, calling it the largest U.S. identity theft prosecution.

The defendants tapped the computer networks of TJX Cos.' Marshalls, BJ's Wholesale Club Inc., Barnes & Noble Inc. bookstores, Sports Authority, Boston Market Corp., OfficeMax Inc., Dave & Buster's restaurants, DSW Inc. shoe stores and Forever 21, the government said today.

``This is the single largest and most complex identity theft case that has ever been charged in this country,'' Attorney General Michael Mukasey said at news conference in Boston. The indictment ``highlights our increasing vulnerability to the theft of personal information.''

The cost of the identity-theft scheme to citizens may total billions of dollars, Mukasey said. Some people may not learn they've been victims ``for months or years,'' he added.

Indictments by federal grand juries in Boston and San Diego charged three U.S. residents and defendants from other countries including Estonia, Ukraine and China with identity theft, fraud and conspiracy, the Justice Department said in a statement.

They allegedly hacked into retailers' data systems by driving around the stores with a laptop, kept the information in personal computers in the U.S. and eastern Europe and converted some of it into ready-to-use bank cards, according to federal prosecutors.

`Sniffer' Software

The defendants installed ``sniffer'' software in the retailers' computer systems to capture credit and debit-card numbers along with passwords and account information, Mukasey said. Some of them encoded credit-card numbers on blank automated-teller cards to withdraw tens of thousands of dollars at a time from ATM machines, the government said.

Some of the same defendants were indicted in Brooklyn, New York, federal court in May, the government said.

The case began as three separate investigations of identity theft in southern California, New York and Boston. The probes were ``eventually coordinated'' after investigators ``realized that one ring of people were involved,'' Mukasey said.

TJX, the Framingham, Massachusetts-based owner of the T.J. Maxx and Marshalls discount chains, said in January 2007 that hackers had broken into its computer system and stolen about 45.7 million credit- and debit-card numbers.

Designer Label

The retailer, which offers designer-label clothes and home goods at discounted prices, in March settled a complaint with the Federal Trade Commission. Under the agreement, TJX must start an information-security program and undergo an external audit every other year for 20 years.
TJX also settled related claims by Visa Inc. and MasterCard Inc. In April. The retailer agreed to pay as much as $24 million to cover costs incurred by banks that issue MasterCards.

``We have worked very closely with law enforcement authorities as they conducted an extensive international investigation into this complex crime,'' TJX spokeswoman Sherry Lang said in an e-mailed statement. ``The sheer number of retailers attacked by these cyber-criminals demonstrates the much broader challenges in protecting sensitive consumer data from this increasing threat.''

In 2005, BJ's Wholesale Club and DSW Inc., the shoe discounter, also settled Federal Trade Commission allegations that they failed to protect customer credit card information from theft by hackers.

DSW Cooperating

DSW is cooperating with the U.S. probe, DSW General Counsel Bill Jordan said in an e-mailed statement. The FTC alleged that both companies failed to use ``readily available security measures'' to prevent hackers from stealing data off their wireless networks used to verify consumers' information.

``This is an old breach. It's from 2004, so we are pleased that progress is being made on this,'' BJ's spokeswoman Julie Somers said. ``We fully cooperated with the U.S. Attorney's office and will continue to do so if asked.''

The company's system now meets all credit card industry standards for protection of customer data, she said.

One of the cases is U.S. v. Gonzalez, 08cr10223, U.S. District Court for the District of Massachusetts (Boston).

Aug 5th, 2008, 08:15 PM	#1
Roo Up to the Minute Mod Location: Rue Roo	U.S. Indicts 11 in Largest U.S. Identity Theft Case http://www.bloomberg.com/apps/news?p...v8&refer=home# U.S. Indicts 11 in Largest U.S. Identity Theft Case (Update2) By Andrew Harris and Heather Burke Aug. 5 (Bloomberg) -- The Justice Department charged 11 people with stealing more than 40 million credit- and debit-card numbers from nine retailers including T.J. Maxx, calling it the largest U.S. identity theft prosecution. The defendants tapped the computer networks of TJX Cos.' Marshalls, BJ's Wholesale Club Inc., Barnes & Noble Inc. bookstores, Sports Authority, Boston Market Corp., OfficeMax Inc., Dave & Buster's restaurants, DSW Inc. shoe stores and Forever 21, the government said today. ``This is the single largest and most complex identity theft case that has ever been charged in this country,'' Attorney General Michael Mukasey said at news conference in Boston. The indictment ``highlights our increasing vulnerability to the theft of personal information.'' The cost of the identity-theft scheme to citizens may total billions of dollars, Mukasey said. Some people may not learn they've been victims ``for months or years,'' he added. Indictments by federal grand juries in Boston and San Diego charged three U.S. residents and defendants from other countries including Estonia, Ukraine and China with identity theft, fraud and conspiracy, the Justice Department said in a statement. They allegedly hacked into retailers' data systems by driving around the stores with a laptop, kept the information in personal computers in the U.S. and eastern Europe and converted some of it into ready-to-use bank cards, according to federal prosecutors. `Sniffer' Software The defendants installed ``sniffer'' software in the retailers' computer systems to capture credit and debit-card numbers along with passwords and account information, Mukasey said. Some of them encoded credit-card numbers on blank automated-teller cards to withdraw tens of thousands of dollars at a time from ATM machines, the government said. Some of the same defendants were indicted in Brooklyn, New York, federal court in May, the government said. The case began as three separate investigations of identity theft in southern California, New York and Boston. The probes were ``eventually coordinated'' after investigators ``realized that one ring of people were involved,'' Mukasey said. TJX, the Framingham, Massachusetts-based owner of the T.J. Maxx and Marshalls discount chains, said in January 2007 that hackers had broken into its computer system and stolen about 45.7 million credit- and debit-card numbers. Designer Label The retailer, which offers designer-label clothes and home goods at discounted prices, in March settled a complaint with the Federal Trade Commission. Under the agreement, TJX must start an information-security program and undergo an external audit every other year for 20 years. TJX also settled related claims by Visa Inc. and MasterCard Inc. In April. The retailer agreed to pay as much as $24 million to cover costs incurred by banks that issue MasterCards. ``We have worked very closely with law enforcement authorities as they conducted an extensive international investigation into this complex crime,'' TJX spokeswoman Sherry Lang said in an e-mailed statement. ``The sheer number of retailers attacked by these cyber-criminals demonstrates the much broader challenges in protecting sensitive consumer data from this increasing threat.'' In 2005, BJ's Wholesale Club and DSW Inc., the shoe discounter, also settled Federal Trade Commission allegations that they failed to protect customer credit card information from theft by hackers. DSW Cooperating DSW is cooperating with the U.S. probe, DSW General Counsel Bill Jordan said in an e-mailed statement. The FTC alleged that both companies failed to use ``readily available security measures'' to prevent hackers from stealing data off their wireless networks used to verify consumers' information. ``This is an old breach. It's from 2004, so we are pleased that progress is being made on this,'' BJ's spokeswoman Julie Somers said. ``We fully cooperated with the U.S. Attorney's office and will continue to do so if asked.'' The company's system now meets all credit card industry standards for protection of customer data, she said. One of the cases is U.S. v. Gonzalez, 08cr10223, U.S. District Court for the District of Massachusetts (Boston). __________________ " We are the first nation in the history of the world to go to the poorhouse in an automobile." -- WILL ROGERS