International Hacker Pleads Guilty To 2011 Global Cyberattack

PRESS RELEASE

Earlier today at the federal courthouse in Brooklyn, Qendrim Dobruna, a member of an international cybercrime organization that was responsible for a cyberattack that inflicted millions of dollars in losses on the global financial system over the course of two days in 2011, pleaded guilty to bank fraud.

The defendant, who was extradited from Germany, and his co-conspirators hacked into the systems of a U.S.-based credit and debit card payment processor that processed debit card transactions for the American Red Cross in connection with disaster relief victims. The stolen card data was then disseminated worldwide and used in an “unlimited operation” that made $14 million in fraudulent withdrawals from ATMs across the globe.

The guilty plea was announced by Loretta E. Lynch, United States Attorney for the Eastern District of New York, and Robert J. Sica, Special Agent in Charge, United States Secret Service, New York Field Office.

“The defendant and his associates hacked into the global financial system and helped themselves to funds using prepaid debit cards meant for the needy and vulnerable,” stated United States Attorney Lynch. “We will continue to work with our private sector partners to solve these 21st century heists and bring the perpetrators, no matter where in the world they may hide, to justice.”

“Our success in this case and other similar investigations is a result of our close work with our law enforcement partners,” said Secret Service Special Agent in Charge Sica. “The Secret Service worked closely with the Department of Justice and INTERPOL to share information and resources that ultimately brought Qendrim Dobruna to justice. This case demonstrates there is no such thing as anonymity for those engaging in data theft and fraudulent schemes.”

As described in the indictment, court filings in related cases, and public court proceedings, the cyberattack employed by the defendant and his co-conspirators is known in the cyber underworld as an “Unlimited Operation” – through its hacking “operation,” the cybercrime organization can access virtually “unlimited” criminal proceeds.

The “Unlimited Operation” begins when the cybercrime organization hacks into the computer systems of a payment card processor, compromises prepaid debit card accounts, essentially eliminates the withdrawal limits of those accounts, and manipulates the security protocols that would alert the victim to the attack. The compromised card data is then distributed to cells worldwide that use the data to encode magnetic stripe cards to use at ATMs. These sophisticated techniques enable the participants to withdraw literally unlimited amounts of cash until the operation is finally detected and shut down. “Unlimited Operations” are marked by three key characteristics:

(1) the surgical precision of the hackers carrying out the cyberattack,

(2) the global nature of the cybercrime organization, and

(3) the speed and coordination with which the organization executes its operations on the ground.

These attacks rely upon both highly sophisticated hackers and organized criminal cells whose role is to withdraw the cash as quickly as possible.

In February 2011 the defendant and his co-conspirators targeted a publicly traded credit and debit card processing company based in the United States that processed transactions for prepaid debit cards issued by the American Red Cross for disaster relief victims. After the hackers penetrated the payment card processor’s computer network, compromised the American Red Cross prepaid card accounts, and manipulated the balances and withdrawal limits, casher cells across the globe operated a coordinated ATM withdrawal campaign. In total, more than 15,000 ATM transactions were conducted in approximately 18 countries using the compromised disaster relief prepaid cards, resulting in $14 million in financial loss worldwide.

The defendant, also known by the aliases “cl0sEd” and “cL0z,” participated in the cyber-attack from overseas by obtaining account information from co-conspirators who directly hacked into the payment card processor’s database and selling that account information to other co-conspirators over the Internet, including to an individual in Brooklyn, New York. The defendant was arrested in an apartment in Stuttgart, Germany in March 2012 by the German federal criminal police and subsequently extradited to the United States.

In announcing the guilty plea, United States Attorney Lynch praised the extraordinary efforts of the Secret Service in investigating this complex network intrusion. Ms. Lynch also thanked the Department of Justice’s Office of International Affairs, INTERPOL, and the authorities in Germany for their assistance in effecting the defendant’s extradition.

Today’s plea took place before Senior United States District Judge I. Leo Glasser. When sentenced on October 24, 2014, the defendant faces up to 30 years in prison, a fine of up to $1 million, and forfeiture of the proceeds of his crimes.

The government’s case is being prosecuted by Assistant United States Attorney Amir H. Toossi.
The Defendant:
QENDRIM DOBRUNA
Age: 27
E.D.N.Y. Docket No. 12 CR 300 (ILG)