Two Romanian hackers have been sentenced to a total of 22 years behind bars in the US for remotely stealing customer payment data from hundreds of American merchants, including 250 Subway restaurants.
Adrian-Tiberiu Oprea, 29, of Constanta and Iulian Dolan, 28, of Craiova, yesterday (September 4) received prison terms of 15 and seven years, respectively, for participating in an international, multimillion-dollar scheme to remotely hack into and steal payment card data from hundreds of US merchants’ computers.
Stealing the information of more than 100,000 US cardholders, the pair, along with co-conspirator Cezar Butu, 27, of Ploiesti, caused losses of at least USD 17.5 million in unauthorized charges and remediation expenses by using the stolen data.
From 2009 to 2011, Oprea, the scheme’s leader, conspired with Dolan and Butu to hack into hundreds of computers in the US to steal credit, debit and payment account numbers and associated data belonging to US cardholders, court documents state.
Oprea and Dolan remotely hacked into hundreds of U.S. merchants’ point-of-sale (POS) or “check out” computer systems, where customers’ payment card data was electronically stored.
In their scheme, Oprea and Dolan, his trusted aide, would first use the internet to identify US-based vulnerable POS systems. After finding such a system, the pair would gain access and install software programs called “keystroke loggers”, also known as “sniffers”.
The sniffer programs would record and store all data keyed into or swiped through the merchants’ POS systems, including customers’ payment card data.
Oprea and Dolan retrieved the card data electronically before transferring it to various electronic storage locations, called “dump sites”, that Oprea had set up.
Oprea later tried to use the stolen payment card data to make unauthorized charges on, or transfers of funds from, the customers' accounts. Both men pleaded guilty to their part in the scam.
On May 7, 2013, Oprea, who was extradited to the United States from Romania, admitted one count of conspiracy to commit computer fraud, one count of conspiracy to commit wire fraud and two counts of conspiracy to commit access device fraud.
While on September 17, 2012, Dolan pleaded guilty to one count of conspiracy to commit computer fraud and two counts of conspiracy to commit access device fraud.
The announcement of their prison term was made by Acting Assistant Attorney General Mythili Raman of the Justice Department’s Criminal Division, U.S. Attorney John P. Kacavas of the District of New Hampshire and Holly Fraumeni, Resident Agent in Charge of the U.S. Secret Service, Manchester, N.H., Resident Office in a statement on the US Justice Department website.
The case, investigated by the U.S. Secret Service, with assistance from the New Hampshire State Police and Romanian authorities, was prosecuted by Trial Attorney Mona Sedky of the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Arnold H. Huftalen of the District of New Hampshire.
Shaun Turton, [email protected]