15 Oct Hack Blotter, Vol. 3, No. 3: Cybercriminal Arrests And Convictions
The convergence of cybersecurity and law enforcement
– Toronto, ON. – Oct. 4, 2019
Q3 was an intense quarter for police, prosecutors and, above all, the victims of cybercrime. The Capital One data hack dominated the news cycle, once again demonstrating the enormous damage that hackers can cause companies. However, the incident also illustrated the positive power of community in the aftermath of the cyberattack.
Capital One set up an email address for tipsters to alert the company to potential vulnerabilities in its computer system. This is what ultimately led to Paige Thompson, the former Amazon.com Inc. employee charged with the cyberattack.
Read on to learn about this story, and other cybersecurity investigations, arrests, and convictions from the past quarter.
RAP SHEET
September
Sept. 28. German authorities raided a data center based out of “former NATO bunker that hosted sites dealing in drugs and other illegal activities,” resulting in seven arrests.
Sept. 27. Cryptocurrency exchange Binance has been collaborating with the Cyber Crime Unit of the UK’s Metropolitan Police Service in a massive investigation into a Bulgarian suspect responsible for allegedly creating and selling phishing scripts that target customers of different services.
Sept. 26. Elliott Gunton, one of the hackers who breached the systems of internet service provider TalkTalk in 2015, faces extradition to the U.S. to answer new charges relating to a cryptocurrency fraud that could result in a 20-year jail term.
Sept. 25. A federal judge barred Roger Stone from contesting Russia’s role in hacking and releasing Democratic emails in the 2016 U.S. presidential election, calling his claims irrelevant to his charged offenses of lying to Congress and witness tampering.
Sept. 23. Russian hacker Andrei Tyurin admitted that he executed the largest known cyberattack against a U.S. bank, pleading guilty to charges that he stole data on more than 80 million clients of JPMorgan Chase & Co. and other institutions.
Sept. 17. Detectives from the Financial and Cyber Crime Group (State Crime Command) closed a complex operation charging four people with a series of significant fraud charges.
Sept. 17. A senior Canadian police intelligence official charged with espionage-related offenses had access to secret information from both domestic and international allies. Cameron Ortis is accused of multiple offenses under the Security of Information Act, as well as two sections of the Criminal Code.
Sept. 17. Jasmine Vella-Arpachi, a 21-year-old Australian woman, faces a broad range of charges relating to fraud, unauthorized access of data and dealing in proceeds of crime. Millions of dollars have allegedly been siphoned from personal superannuation and share trading accounts as part of a sophisticated online fraud syndicate.
Sept. 16. Andrei Tyurin, a Russian hacker at the center of an alleged scheme to steal financial data on more than 80 million JPMorgan Chase & Co. clients, stated that he will plead guilty later this month, according to a U.S. court filing.
Sept. 13. The Trump administration on Friday imposed sanctions on the Lazarus Group and two subgroups dubbed Bluenoroff and Andariel, a notorious constellation of North Korean hackers believed to be responsible for dozens of cyberattacks around the world, including the 2014 hacking of Sony Pictures.
Sept. 13. A British teen was arrested for hacking into caches of unreleased music from world-renowned artists — and then peddling the rare recordings for cryptocurrency, authorities charged Friday.
Sept. 5. Two New York men were arrested and charged with hacking into a medical facility, stealing PII and then using it to dox 38 New Jersey public employees, most of whom were police officers.
Sept. 4. A 21-year-old from Vancouver, Washington pleaded guilty to creating and operating multiple iterations of DDoS botnets made up of home routers and other networking and Internet of Things (IoT) devices.
Sept. 3. Convicted bank scammer Jason Mickel Elcock, aka “Prezzi,” has been sentenced to 57 months in prison with three years of “supervised release,” according to a press release from the Department of Justice.
Sept. 2. Police have arrested a French national of Chinese origin and three Nepalis in connection with the country’s biggest cyber heist in the banking sector committed by Chinese nationals to steal millions of rupees from ATMs.
August
Aug. 28. Almost a month after Paige Thompson was arrested based on allegations that she hacked into servers rented by Capital One Financial Corporation, a criminal indictment was returned charging her with one count each of computer and wire fraud, as well as forfeiture allegations.
Aug. 25. NASA is allegedly investigating an accusation that an astronaut accessed a bank account belonging to an estranged spouse while aboard the International Space Station. If the allegations of identity theft and improper account access turn out to be accurate, this could be the first cybercrime committed in space.
Aug. 23. A judge ordered the confiscation of bitcoin worth more than £900,000 from a jailed hacker in order to pay back his victims.
Aug. 23. Australian citizen Katherine Nguyen pleaded guilty to stealing $450,000 in XRP — over 100,000 tokens — in January 2018. Nguyen hacked into the email account of a man with the same last name and proceeded to steal all of his XRP, before unlocking his account two days later.
Aug. 23. A Seattle judge decided to keep Paige Thompson, the suspect arrested on accusations of hacking Capital One, under custody until her trial. The judge ruled that Thompson was a flight risk, and a threat to herself and others, and should remain detained for the time being.
Aug. 22. Israel is easing export rules on offensive cyber weapons, despite accusations by human rights and privacy groups that its technologies are used by some governments to spy on political foes and crush dissent.
Aug. 22. The Justice Department has indicted dozens of individuals accused of involvement in a massive business email scam and money laundering scheme.
Aug. 19. A British teenager has been sentenced to 20 months in prison after offering hacker-for-hire services to cash in on trends including SIM-swapping attacks.
Aug. 18. A cyber fraudster who duped around 60 people by allegedly hacking their email IDs and withdrawing money from e-wallets has been arrested.
Aug. 17. Nigerian billionaire Obinwanne Okeke was allegedly arrested by the U.S. Federal Bureau of Investigation for conspiracy to commit fraud amount to $12 million dollars.
Aug. 14. Prosecutors said they found multiple terabytes of stolen data from other companies, educational institutions and other organizations on seized servers from the bedroom of Paige Thompson, a former employee of Amazon Web Services who was accused of the high-profile Capital One data heist.
Aug. 12. A man who hacked into two police websites as revenge for being convicted of a bomb hoax has been detained. Liam Watts, 20, of Chorley, England, used software to overload Greater Manchester Police’s (GMP) website in August 2018 and Cheshire Police’s site in March.
Aug. 9. Police have charged a 25-year-old New Zealand man with hacking into a company’s computer system and allegedly obtaining thousands of customers’ personal information.
Aug. 7. The Department of Justice unveiled charges against a Pakistani man who allegedly bribed AT&T employees to illegally unlock cellphones on the company’s network.
Aug. 3. Capital One and GitHub have been sued as part of a class-action lawsuit filed in California on allegations of failing to secure or prevent a security breach during which the personal details of more than 106 million users were stolen by a hacker.
Aug. 1. The software engineer accused in a massive Capital One data breach that exposed personal information of millions of customers recently threatened to “shoot up” a California social media company, federal prosecutors allege.
July
Jul. 30. A tipster’s e-mail is reportedly what led to the arrest in the massive Capital One breach.
Jul. 29. Federal officials arrested a Seattle woman and accused her of stealing records, including some bank account and Social Security numbers, from more than 100 million Capital One customers and potential customers.
Jul. 27. The British cybersecurity expert credited with helping stop a worldwide computer virus in May 2017 won’t serve any additional time behind bars for creating malware years before he won international acclaim.
Jul. 25. United States prosecutors filed a complaint against the defunct cryptocurrency exchange BTC-e and its alleged former operator, Alexander Vinnik. The indictment was filed nearly 24 months after Vinnik was arrested in Greece.
Jul. 24. Police arrested a 25-year-old man from Bradford, England on suspicion of committing Computer Misuse Act crimes after Lancaster University suffered a data breach affecting more than 12,000 students and applicants.
Jul. 24. Brazil’s federal police have arrested four people for allegedly hacking the phone of the justice minister, Sérgio Moro, a key member of the far-right president Jair Bolsonaro’s cabinet who had previously been a renowned anti-corruption judge.
Jul. 23. Three men from Romania have been given prison sentences in the United States varying between four and eight years for a fraud scheme worth more than $21 million.
Jul. 22. A federal judge in California has given a cryptocurrency entrepreneur another shot to make his case that AT&T’s negligence allowed hackers to steal $24 million in digital currency. Hackers attacked blockchain and cryptocurrency investor Michael Terpin’s cellphone on two separate occasions.
Jul. 21. A Bulgarian cybersecurity expert accused of hacking the data of more than 5 million Bulgarian taxpayers was released by police after his charges were downgraded.
Jul. 19. Dutch authorities announced the arrest of a 20-year old man for allegedly developing and distributing Office Macro Builders. Such programs are designed to allow cybercriminals weaponize Office documents to deliver malicious payloads via obfuscated macro code.
Jul. 17. A 20-year-old Bulgarian cybersecurity worker has been arrested and charged with hacking the personal and financial records of millions of taxpayers.
Jul. 16. The Ukraine arrested an alleged major computer hacker who has been sought by the United States for years. The head of Ukraine’s national security service Ivan Bakanov said Tuesday that Mykhailo Rytikov was arrested in the city of Odessa, in an operation conducted in coordination with Britain and the U.S.
Jul. 5. Austin Thompson, a hacker who targeted Xbox, PlayStation, and Steam with DDOS attacks back in 2013, was sentenced to 27 months in prison and ordered to pay $95,000 in restitution.
Jul. 1. Two Israeli brothers were arrested in connection with the 2016 Bitfinex hack and other crypto-related phishing attacks.
– Morag McGreevey is a freelance writer covering cybersecurity, national security, VC deals, and investing.
