NEW YORK (5/13/13)--An alleged international gang of cybercriminals stole $45 million by hacking their way into a database of prepaid debit cards and then draining ATMs worldwide, federal prosecutors said Thursday.
Eight members of the alleged gang's New York City crew stole about $2.4 million from about 3,000 ATMs in the metropolitan area during February, according to a four-count conspiracy and money-laundering indictment unsealed in Brooklyn (USA Today May 10).
After reaching out to its member credit unions in the New York City area Friday, the Credit Union Association of New York could not identify any credit unions with ATMs that had been compromised in the attack.
"New York City has a ton small credit unions," said Ron McLean, CUANY senior vice president of support services. "Most of them do not have a lot of ATMs."
The ATMs of Municipal FCU, New York, the largest state-chartered credit union in New York City, do not appear to have been compromised in the attack, Michael Mattone, the credit union's assistant vice president of public relations and corporate communications told News Now.
"We have not been contacted by authorities," Mattone said. "Our security department is double checking to be sure that none of our ATMs were used in the attacks."
The cybercriminals would hack into the computer systems of credit card processors, steal information involving prepaid debit card accounts and eliminate the withdrawal limits and balances of those accounts. Organized crime cells would then withdraw unlimited amounts of cash from ATMs before the operations would be shut down.
Thieves carried out two lucrative unlimited operations between October 2012 and last month, the indictment said. In the first attack, hackers working with the gang on Dec. 22 allegedly targeted a credit card processor that handled prepaid MasterCard debit cards issued by the National Bank of Ras Al-Khaimah, a United Arab Emirates bank also known as Rakbank.
The second unlimited operation allegedly took place between the afternoon of Feb. 19 and the pre-dawn hours of the following day. Hackers allegedly compromised computers of the processor of prepaid debit cards for the Bank of Muscat, located in Oman. In about 10 hours, gang members in 24 countries conducted about 36,000 ATM transactions, withdrawing an rougly $40 million, the indictment said. The withdrawals included $2.4 million by the alleged New York crew.