Feds Bust Credit Card Fraud Ring

A Dutch man accused of running an underground website devoted to the buying and selling of debit and credit card data appeared in a Seattle federal courtroom Monday, where he plead not guilty to a 14-count indictment accusing him of crimes such as access device fraud, bank fraud, and aggravated identity theft.

The Department of Justice said that it had coordinated the arrest of David Benjamin Schrooten (a.k.a "Fortezza"), 21, in Romania this past March, before he was escorted back to the United States by agents from the U.S. Marshals Service, arriving Saturday in Seattle.

"This defendant has wrought havoc on victims and financial institutions around the world," said U.S. attorney Jenny A. Durkan, who chairs the Attorney General's advisory committee on cybercrime and intellectual property enforcement, at a news conference. "This indictment alleges that in just one transaction he trafficked in as many as 44,000 stolen credit card numbers resulting in millions of dollars in losses to financial institutions."

Authorities said the 44,000 credit card numbers stemmed from just one sale.

[ Is your database at risk? Read MySQL Database Flaw Leaves Passwords Vulnerable. ]

Authorities said they'd also arrested Maryland-based Christopher A. Schroebel, 21, on related charges--including bank fraud--in November 2011. In May, Schroebel plead guilty to the charges, and he's due to be sentenced in August.

Authorities have accused Schrooten and Schroebel of marketing stolen credit card numbers via Internet "carding" sites. They've also accused Schroebel of hacking into two Seattle-area businesses' networks, and stealing credit card data by installing malware that copied data from point-of-sale systems onto a server he controlled in Kansas.

According to court documents, "Schroebel stole at least 4,800 credit card numbers ... [and] conspired and worked with Schrooten to build 'carding websites,' in order to make the stolen credit card numbers available to criminals for fraud." Some of the stolen information relating to people's personal bank accounts was then used to commit bank fraud, authorities said.

The Seattle Police Department (SPD) said it began investigating the case after a business in Magnolia, Wash., reported that its customers had begun experiencing credit card fraud that seemed to have originated with the restaurant.

In a Monday news conference, the restaurant's owner, Corino Bonjrada, said some of his customers saw charges of $70 or $80, just minutes after using their credit card at his restaurant, reported CBS News.

"SPD detectives on loan to the Electronic Crimes Task Force quickly matched this case with other patterns and connected the dots to an international criminal enterprise," said assistant Seattle police chief Jim Pugel. "Solving this case would not have been possible without the assistance and cooperation of our partners in the Secret Service and the Romanian National Police."

Security information and event monitoring technology has been available for years, but the information can be hard to mine. In our SIEM Success report, we provide a step-by-step guide to make the most of your SIEM system. (Free registration required.)