01:10 PM

Feds Bust Credit Card Fraud Ring

A Dutch man, together with Maryland accomplice, is accused of running a site for buying and selling credit card data.

A Dutch man accused of running an underground website devoted to the buying and selling of debit and credit card data appeared in a Seattle federal courtroom Monday, where he plead not guilty to a 14-count indictment accusing him of crimes such as access device fraud, bank fraud, and aggravated identity theft.

The Department of Justice said that it had coordinated the arrest of David Benjamin Schrooten (a.k.a "Fortezza"), 21, in Romania this past March, before he was escorted back to the United States by agents from the U.S. Marshals Service, arriving Saturday in Seattle.

"This defendant has wrought havoc on victims and financial institutions around the world," said U.S. attorney Jenny A. Durkan, who chairs the Attorney General's advisory committee on cybercrime and intellectual property enforcement, at a news conference. "This indictment alleges that in just one transaction he trafficked in as many as 44,000 stolen credit card numbers resulting in millions of dollars in losses to financial institutions."

Authorities said the 44,000 credit card numbers stemmed from just one sale.

[ Is your database at risk? Read MySQL Database Flaw Leaves Passwords Vulnerable. ]

Authorities said they'd also arrested Maryland-based Christopher A. Schroebel, 21, on related charges--including bank fraud--in November 2011. In May, Schroebel plead guilty to the charges, and he's due to be sentenced in August.

Authorities have accused Schrooten and Schroebel of marketing stolen credit card numbers via Internet "carding" sites. They've also accused Schroebel of hacking into two Seattle-area businesses' networks, and stealing credit card data by installing malware that copied data from point-of-sale systems onto a server he controlled in Kansas.

According to court documents, "Schroebel stole at least 4,800 credit card numbers ... [and] conspired and worked with Schrooten to build 'carding websites,' in order to make the stolen credit card numbers available to criminals for fraud." Some of the stolen information relating to people's personal bank accounts was then used to commit bank fraud, authorities said.

The Seattle Police Department (SPD) said it began investigating the case after a business in Magnolia, Wash., reported that its customers had begun experiencing credit card fraud that seemed to have originated with the restaurant.

In a Monday news conference, the restaurant's owner, Corino Bonjrada, said some of his customers saw charges of $70 or $80, just minutes after using their credit card at his restaurant, reported CBS News.

"SPD detectives on loan to the Electronic Crimes Task Force quickly matched this case with other patterns and connected the dots to an international criminal enterprise," said assistant Seattle police chief Jim Pugel. "Solving this case would not have been possible without the assistance and cooperation of our partners in the Secret Service and the Romanian National Police."

Security information and event monitoring technology has been available for years, but the information can be hard to mine. In our SIEM Success report, we provide a step-by-step guide to make the most of your SIEM system. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest September 7, 2015
Some security flaws go beyond simple app vulnerabilities. Have you checked for these?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-08
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Published: 2015-10-08
Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended login restrictions or obtain sensitive information, by leveraging certain group-administration privile...

Published: 2015-10-08
The REST interface in Cisco Unified Communications Manager IM and Presence Service 11.5(1) allows remote attackers to cause a denial of service (SIP proxy service restart) via a crafted HTTP request, aka Bug ID CSCuw31632.

Published: 2015-10-08
Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0), 7.3(101.0), and 7.4(1.19) allow remote attackers to cause a denial of service (device outage) by sending malformed 802.11i management data to a managed access point, aka Bug ID CSCub65236.

Published: 2015-10-06
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 21335999.

Dark Reading Radio
Archived Dark Reading Radio
What can the information security industry do to solve the IoT security problem? Learn more and join the conversation on the next episode of Dark Reading Radio.