HACKER GETS SEVEN YEARS IN PRISON FOR STEALING OVER 240,000 CREDIT CARD NUMBERS

FROM: U.S. DEPARTMENT OF JUSTICE
Wednesday, July 18, 2012
Hacker Sentenced to Seven Years in Prison for Role
in Two Hacking Schemes Involving a Total of More Than 240,000 Stolen Credit Card
Numbers

WASHINGTON – Aleksandr Suvorov, of Estonia, was sentenced today to seven years in prison for his role in two separate hacking schemes involving a total of more than 240,000 stolen credit card numbers.

The sentence was announced today by Assistant Attorney General Lanny A. Breuer for the Criminal Division, U.S. Attorney for the Eastern District of New York Loretta E. Lynch, U.S. Attorney for the Southern District of California Laura E. Duffy and Director of the U.S. Secret Service Mark Sullivan.

Suvorov, 28, was sentenced by U.S. District Judge Sandra J. Feuerstein in Central Islip, N.Y. Suvorov was an accomplice to Albert Gonzalez, one of the most prolific identity thieves ever prosecuted by the U.S. government.

Suvorov pleaded guilty in May 2009 to a wire fraud conspiracy charge, filed in the Eastern District of New York, for hacking into the national restaurant chain Dave & Buster’s and stealing more than 80,000 credit card numbers. In addition, Suvorov pleaded guilty in November 2011 to a trafficking in unauthorized access devices charge, originally filed in the Southern District of California, related to the sale of more than 160,000 stolen credit card numbers to an undercover agent with the U.S. Secret Service. The cases were consolidated in the Eastern District of New York for sentencing. In addition to his prison term, Suvorov was ordered to pay $675,000 in restitution and to satisfy a $300,000 asset forfeiture judgment stemming from the New York charges.

"Mr. Suvorov participated in a scheme to sell thousands of credit card numbers stolen from unsuspecting consumers," said Assistant Attorney General Breuer. "Computer hackers like Mr. Suvorov victimize businesses and individuals, posing a serious threat to their financial security. Today’s sentence sends a clear message that cyber criminals operating abroad will suffer severe consequences for their crimes."

"Suvorov reached across an ocean to victimize thousands of Americans," said U.S. Attorney Lynch. "That ocean was no protection from the reach of U.S. law enforcement, whose coordinated efforts put a stop to Suvorov and his cohorts’ criminal scheme. He will now serve his sentence in the country of his victims. Computer hackers and identity thieves who prey on innocent American consumers, businesses and financial institutions will find no refuge from U.S. criminal justice in any corner of the globe."

"This international criminal enterprise thought that they could traffic in stolen credit card information from abroad, but due to the coordinated efforts of the United States Secret Service and the Justice Department, they were wrong," said U.S. Attorney Duffy. "The agents of the San Diego field office of the United States Secret Service are to be commended for their investigative work in dismantling this organization."

"This case demonstrates the potential for criminals to inflict significant damage to our nation’s financial sector, but this investigation and the resulting sentences should serve as a warning to cyber criminals that law enforcement will continue to pursue them wherever they are," said U.S. Secret Service Director Sullivan. "The Secret Service, in conjunction with its many law enforcement partners across the United States and around the world, continues to successfully combat these crimes by adapting our investigative methodologies. We realize our success in this investigation is due to the cooperation of these partners in more than a dozen international law enforcement agencies."

According to court documents, in the New York case, Suvorov, Albert Gonzalez and a third co-conspirator devised a scheme to gain unauthorized access into the computer systems of Dave & Buster’s Inc. for the purposes of installing malicious software and extracting credit card information of the Dave & Buster’s patrons. Gonzalez, who was in Miami, sent the software, known as a "packet sniffer," to a co-conspirator in Ukraine. A packet sniffer is malicious software designed, in this case, to collect credit card information. The co-conspirator in Ukraine then provided the packet sniffer to Suvorov in Estonia. Suvorov, working with another individual, gained unauthorized access to 11 Dave & Buster’s restaurants throughout the United States, one of which was in Islandia, N.Y., and installed the packet sniffer. Suvorov and his co-conspirators ultimately obtained data from 81,005 credit cards.

Gonzalez was sentenced in March 2010 to 20 years in prison for his role in the Dave & Buster’s hack, as well as hacks into a major payment processor and several retail networks. The other co-conspirator was arrested in Turkey on related identity theft charges, and was sentenced there to 30 years in prison.

In the California case, Suvorov and an accomplice conspired to sell more than 160,000 stolen credit card numbers to a buyer in San Diego who was an undercover agent with the U.S. Secret Service. Suvorov provided the stolen credit card numbers to an accomplice, who in turn sold them to the undercover agent.

The New York case was prosecuted by Assistant U.S. Attorney William Campos of the Eastern District of New York and Trial Attorneys James Silver and Evan Williams of the Criminal Division’s Computer Crime & Intellectual Property Section (CCIPS) and was investigated by the U.S. Secret Service Criminal Investigative Division Cyber Investigations Branch. Former CCIPS Assistant Deputy Chief Howard Cox and Senior Counsel Kimberly Peretti also contributed significantly to the investigation and prosecution of this case. The California case was prosecuted by Assistant U.S. Attorney Orlando Gutierrez of the Southern District of California and investigated by the U.S. Secret Service San Diego Field Office. The Office of International Affairs in the Criminal Division provided significant assistance.