Cyberthieves Who Hit 7-Eleven, JCPenney And Hannaford Are Indicted

Cyberthieves who stole 160 million credit and debit card numbers from 7-Eleven, JCPenney (NYSE:JCP), grocery chain Hannaford, French retail giant Carrefour and about a dozen other companies were indicted by federal prosecutors in New Jersey on Thursday (July 25), the AP reported.

The thieves—four Russian nationals and a Ukrainian—allegedly acquired the huge haul of card numbers by breaking into corporate computer networks, stealing card data and then selling the numbers to others who used them to get money from ATMs. Prosecutors said losses from the network were at least in the hundreds of millions of dollars.

Along with the retailers, other victims of the cyberattacks include payments processor Heartland, the NASDAQ stock exchange and airline JetBlue.

The five cyberthieves were identified as Russians Vladimir Drinkman, Aleksander Kalinin, Roman Kotov and Dmitriy Smilianets, and Ukrainian Mikhail Rytikov. Prosecutors said one suspect is in the Netherlands and another is due to appear in U.S. court next week. They didn't specify whether any of the others were in custody.

The indictments build on the case of notorious cyberthief Albert Gonzalez, who was sentenced to 20 years in prison in 2010 for highly successful attacks largely on retailers and restaurants. Gonzalez is identified as an unindicted co-conspirator in the new complaint.

The Gonzalez case is old enough that it has been repeatedly profiled by reality television shows, and the fact that Gonzalez was sentenced in 2010 may make it seem like ancient history. In practice, though, lawsuits over those breaches are still going—in April, lawyers tried again to launch a class-action lawsuit against Hannaford because of failures that led to its breach—and the indictment makes clear that the newly accused members of the gang continued to break into networks and steal card numbers until at least 2012.

For more:

- See this Associated Press story
- See this New York Times story

Related stories:

Ringleader Arrested In $200 Million Online-Retailer Card Breach
Was Your Card Processor The One Hit In A $40 Million Breach?
The Hannaford Data Breach Case Lives On. Lawyers Ask For Judge To Reverse Himself