Attacks/Breaches

2/16/2018
09:50 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Russian Hackers Sentenced in Heartland Payment Systems Breach Case

Two more men involved in the massive payment card theft from multiple major US corporations that began in 2007 now sent to federal prison.

It's been 10 years since the historic and widespread payment card data breaches at Heartland Payment Systems, NASDAQ, and other major US companies, and this week two members of the group of cybercriminals that pulled off those hacks were sentenced to federal prison.

Russian citizens Vladimir Drinkman, 37, of Syktyvkar and Moscow, Russia, and Dmitriy Smilianets, 34, of Moscow, both of whom had pleaded guilty in 2013, were part of a team working with the infamous Albert Gonzalez that stole data from Heartland, NASDAQ, 7-Eleven, Carrefour, JCP, Hannaford, Dow Jones, Wet Seal, Commidea, Dexia, JetBlue, Euronet, Visa Jordan, Global Payment, Diners Singapore, and Ingenicard.

Drinkman was sentenced to 12 years in prison for conspiracy to commit unauthorized access of protected computers as well as one count of conspiracy to commit wire fraud. Smilianets, who had pleaded guilty to conspiracy to commit wire fraud that affected a financial institution, will face 51 months and 21 days in prison. Each also faces three years of supervised release at the end of their prison terms. They were arrested in the Netherlands in June of 2012; Smilianets was extradited to the US in September of that year, and Drinkman, in 2015.

The cyberattacks resulted in the theft of some 160 million credit card numbers and over $300 million in losses, and it's the largest such cybercrime case ever prosecuted in the US. Two other men who were indicted remain at large: Roman Kotov, 36, of Moscow, and Mikhail Rytikov, 30, of Odessa, Ukraine.

Drinkman and Kalinin hacked into the targeted companies' networks and infiltrated their systems, and then with the help of Kotov, Drinkman exfiltrated the payment card and other sensitive data, including user credentials and personal information. Rytikov provided anonymous Web hosting services to the hackers to hide their activity. Smilianets then sold the stolen information and paid the attackers their cut.

The attackers used encrypted channels to communicate with one another, and in some cases met one another in person in case law enforcement was able to trace their electronic communications. They remained under the radar within the victim organization networks by evading security software and disabling electronic logging of their activities.

In 2009, Drinkman and Kalinin were charged as "Hacker 1" and "Hacker 2" in an indictment charging Gonzalez – who is serving a 20-year prison sentence - for breaches at Heartland, Hannaford's, 7-Eleven, TJX, and others. Gonzalez conducted most of his hacking during 2005 to 2008 while he served as a paid undercover informant for the US Secret Service. He called his cybercrime enterprise "Operation Get Rich Or Die Tryin.'" 

Acting US Attorney William E. Fitzpatrick said of Drinkman and Kalinin after their sentencing: "These defendants operated at the highest levels of illegal hacking and trafficking of stolen identities. They used their sophisticated computer skills to infiltrate computer networks, steal information and sell it for a profit. Perpetrators of some of the largest data breaches in history, these defendants posed a real threat to our economy, privacy and national security, and cannot be tolerated."

The pair did not receive the maximum sentencing penalties for their crimes, however. Marcus Christian, a partner in the Washington, DC office of law firm Mayer Brown, notes that Drinkman and Smilianets each entered plea deals, which explains their relatively light prison terms and the seemingly long time between their arrests and ultimate sentencing. "You rarely see someone [with Drinkman's high Sentencing Guidelines score] getting 12 years," Christian says. A person with no criminal record and Drinkman's score can receive a sentence of 360 months, he explains, so it may be that the two cooperated with authorities in the investigation.

The attackers mostly exploited SQL injection vulnerabilities in the targeted companies' computers, where they then planted backdoor malware that provided them a foothold in the network, in some cases for more than a year. They employed "sniffer" programs to root out and pilfer the data, storing the stolen information in systems scattered around the globe.

What this data breach case demonstrates, says Christian, is that "persistence matters" for law enforcement. "It also takes a lot of resources for some of the better and more elusive cybercriminals," says Christian, who handles cybercrime and white-collar crime investigation cases. "The case was initiated in 2009, and [some of the events] took place several years before that. It was quite an undertaking."

Related Content:

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Why We Need a 'Cleaner Internet'
Darren Anstee, Chief Technology Officer at Arbor Networks,  4/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11506
PUBLISHED: 2019-04-24
In GraphicsMagick from version 1.3.30 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WriteMATLABImage of coders/mat.c, which allows an attacker to cause a denial of service or possibly have unspecified other impact via a crafted image file. This is related to Expo...
CVE-2019-8991
PUBLISHED: 2019-04-24
The administrator web interface of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, and TIB...
CVE-2019-8992
PUBLISHED: 2019-04-24
The administrative server component of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO ActiveMatrix Service Grid Distribution for TIBC...
CVE-2019-8993
PUBLISHED: 2019-04-24
The administrative web server component of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO ActiveMatrix Service Grid Distribution for ...
CVE-2019-8994
PUBLISHED: 2019-04-24
The workspace client of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contains vulnerabilities where an authenticated user can change settings that can theoretically adversely impact oth...