Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

2/16/2018
09:50 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Russian Hackers Sentenced in Heartland Payment Systems Breach Case

Two more men involved in the massive payment card theft from multiple major US corporations that began in 2007 now sent to federal prison.

It's been 10 years since the historic and widespread payment card data breaches at Heartland Payment Systems, NASDAQ, and other major US companies, and this week two members of the group of cybercriminals that pulled off those hacks were sentenced to federal prison.

Russian citizens Vladimir Drinkman, 37, of Syktyvkar and Moscow, Russia, and Dmitriy Smilianets, 34, of Moscow, both of whom had pleaded guilty in 2013, were part of a team working with the infamous Albert Gonzalez that stole data from Heartland, NASDAQ, 7-Eleven, Carrefour, JCP, Hannaford, Dow Jones, Wet Seal, Commidea, Dexia, JetBlue, Euronet, Visa Jordan, Global Payment, Diners Singapore, and Ingenicard.

Drinkman was sentenced to 12 years in prison for conspiracy to commit unauthorized access of protected computers as well as one count of conspiracy to commit wire fraud. Smilianets, who had pleaded guilty to conspiracy to commit wire fraud that affected a financial institution, will face 51 months and 21 days in prison. Each also faces three years of supervised release at the end of their prison terms. They were arrested in the Netherlands in June of 2012; Smilianets was extradited to the US in September of that year, and Drinkman, in 2015.

The cyberattacks resulted in the theft of some 160 million credit card numbers and over $300 million in losses, and it's the largest such cybercrime case ever prosecuted in the US. Two other men who were indicted remain at large: Roman Kotov, 36, of Moscow, and Mikhail Rytikov, 30, of Odessa, Ukraine.

Drinkman and Kalinin hacked into the targeted companies' networks and infiltrated their systems, and then with the help of Kotov, Drinkman exfiltrated the payment card and other sensitive data, including user credentials and personal information. Rytikov provided anonymous Web hosting services to the hackers to hide their activity. Smilianets then sold the stolen information and paid the attackers their cut.

The attackers used encrypted channels to communicate with one another, and in some cases met one another in person in case law enforcement was able to trace their electronic communications. They remained under the radar within the victim organization networks by evading security software and disabling electronic logging of their activities.

In 2009, Drinkman and Kalinin were charged as "Hacker 1" and "Hacker 2" in an indictment charging Gonzalez – who is serving a 20-year prison sentence - for breaches at Heartland, Hannaford's, 7-Eleven, TJX, and others. Gonzalez conducted most of his hacking during 2005 to 2008 while he served as a paid undercover informant for the US Secret Service. He called his cybercrime enterprise "Operation Get Rich Or Die Tryin.'" 

Acting US Attorney William E. Fitzpatrick said of Drinkman and Kalinin after their sentencing: "These defendants operated at the highest levels of illegal hacking and trafficking of stolen identities. They used their sophisticated computer skills to infiltrate computer networks, steal information and sell it for a profit. Perpetrators of some of the largest data breaches in history, these defendants posed a real threat to our economy, privacy and national security, and cannot be tolerated."

The pair did not receive the maximum sentencing penalties for their crimes, however. Marcus Christian, a partner in the Washington, DC office of law firm Mayer Brown, notes that Drinkman and Smilianets each entered plea deals, which explains their relatively light prison terms and the seemingly long time between their arrests and ultimate sentencing. "You rarely see someone [with Drinkman's high Sentencing Guidelines score] getting 12 years," Christian says. A person with no criminal record and Drinkman's score can receive a sentence of 360 months, he explains, so it may be that the two cooperated with authorities in the investigation.

The attackers mostly exploited SQL injection vulnerabilities in the targeted companies' computers, where they then planted backdoor malware that provided them a foothold in the network, in some cases for more than a year. They employed "sniffer" programs to root out and pilfer the data, storing the stolen information in systems scattered around the globe.

What this data breach case demonstrates, says Christian, is that "persistence matters" for law enforcement. "It also takes a lot of resources for some of the better and more elusive cybercriminals," says Christian, who handles cybercrime and white-collar crime investigation cases. "The case was initiated in 2009, and [some of the events] took place several years before that. It was quite an undertaking."

Related Content:

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/13/2020
Where Are the 'Great Exits' in the Data Security Market?
Dave Cole, Cofounder and CEO, Open Raven,  10/13/2020
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15256
PUBLISHED: 2020-10-19
A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and settin...
CVE-2020-15261
PUBLISHED: 2020-10-19
On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users (both students and teachers) usually don't have administr...
CVE-2020-6084
PUBLISHED: 2020-10-19
An exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-Bradley Flex IO 1794-AENT/B 4.003. A specially crafted network request can cause a loss of communications with the device resulting in denial-of-service. An attacker can send a malic...
CVE-2020-6085
PUBLISHED: 2020-10-19
An exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-Bradley Flex IO 1794-AENT/B 4.003. A specially crafted network request can cause a loss of communications with the device resulting in denial-of-service. An attacker can send a malic...
CVE-2020-10746
PUBLISHED: 2020-10-19
A flaw was found in Infinispan version 10, where it permits local access to controls via both REST and HotRod APIs. This flaw allows a user authenticated to the local machine to perform all operations on the caches, including the creation, update, deletion, and shutdown of the entire server.