By Kevin Poulsen
November 05, 2008
Three New Yorkers accused of using hacked Citibank ATM card numbers and
PINs to steal $2 million from customer accounts in four months have
pleaded guilty to federal conspiracy and access device fraud charges.
The defendants -- Ivan Biltse, Angelina Kitaeva and Yuriy Rakushchynets,
aka Yuriy Ryabinin -- are among 10 suspects charged earlier this year in
connection with a breach of a server that processes ATM transactions
from 7-Eleven convenience stores. Those ATMs are branded Citibank, but
they're owned by Houston-based Cardtronics.
Court records indicate a Russian hacker cracked the ATM server in late
2007, and monitored transactions from 7-Eleven cash machines long enough
to capture thousands of account numbers and PINs. The Russian then
farmed out the stolen data to mules in the United States, who burned the
account numbers onto blank mag-stripe cards and withdrew cash from
Citibank ATMs in the New York area for at least five months, sending 70
percent of the take back to Russia.
Citibank reported the breach to the FBI in February. In a separate
investigation, U.S. Secret Service agents had already identified
Rakushchynets as a member of the computer underground, and they tied him
to the Citibank heist after comparing ATM surveillance photos to
pictures of Rakushchynets posted on ham radio websites.
In January, two other alleged cashers -- Nue Quni and Luma Bitti -- were
arrested after a lucky traffic stop caught them with blank cards and a
mag-stripe writer in their car. Bitti cooperated in the investigation
and led the FBI to two more suspects, Andrey Baranets and Aleksandr
Desevoh, who were arrested in New York after meeting with -- and
attempting to mug -- an undercover FBI agent.
Visit the InfoSec News Security Bookstore
Best Selling Security Books and More!