Romanians sentenced in $17.5 million hacking scheme
CONCORD -; The Romanian leader of an international, $17.5 million hacking ring that remotely accessed hundreds of U.S. merchants' computers to retrieve payment card data of more than 100,000 cardholders was sentenced Thursday to 15 years in federal prison.
Adrian-Tiberiu Oprea, 29, of Constanta, Romania, was sentenced in U.S. District Court on one count each of conspiracy to commit computer fraud, conspiracy to commit wire fraud and two counts of conspiracy to commit access device fraud. His trusted aide, Iulian Dolan, 28, of Craiova, Romania, was sentenced to seven years after pleading guilty to one count of conspiracy to commit computer fraud and two counts of conspiracy to commit access device fraud.
Oprea, who was extradited to the U.S. from Romania, pleaded guilty on May 7 to the charges, while Dolan entered guilty pleas last September.
According to court documents, the scheme was in place for two years, from 2009 to 2011. Oprea headed the crew that included Cezar Butu, 27, of Ploiesti, Romania, that hacked into hundreds of computers located in the U.S. to steal credit, debit and payment account numbers and associated data, known collectively as “payment card data” that belonged to U.S. cardholders. In January, Butu was sentenced to 21 months in prison for his part in the scheme.
Oprea and Dolan remotely hacked into hundreds of U.S. businesses' point-of-sale (POS) or “check out” computer systems, where customers'; payment card data was electronically stored.
Dolan first used the Internet to identify U.S.-based vulnerable POS systems and then he and Oprea would gain access and install software programs called “keystroke loggers” (or “sniffers”) onto the POS systems.
The programs would record, and then store, all of the data that was keyed into or swiped through the merchants'; POS systems, including customers'; payment card data. They retrieved the card data and then electronically transferred it to various electronic storage locations called “dump sites” that Oprea had set up. Oprea later attempted to use the stolen payment card data to make unauthorized charges on, or transfers of funds from, the accounts.
He also attempted to transfer the stolen payment card data to other co-conspirators for them to use in a similar manner.
Among the businesses that were hacked were 250 Subway restaurants, including one in Plaistow. The Romanians stole payment card data belonging to more than 100,000 U.S. cardholders, prosecutors said, and caused losses of at least $17.5 million in unauthorized charges and other expenses.
The group also allegedly created phony plastic credit cards using hardware and software devices, including magnetic strip readers/writers, to encode blank plastic cards with the stolen credit card information. Those fake credit cards were mainly used for purchases in Europe, according to court documents.
In a prepared statement, U.S. Attorney John P. Kacavas said the “sentences imposed on these Romanian defendants serve as notice to cyber criminals across the globe that any attempt to victimize American citizens and commerce will be punished severely. While the threats posed by cyber criminals continue to evolve, we will match those threats with the latest technology and with unprecedented partnerships like those forged here among the U.S. Secret Service, Romanian law enforcement authorities, the New Hampshire State Police and the private sector.”
The case was investigated by the U.S. Secret Service, with assistance from the state police and Romanian authorities.