http://www.star-telegram.com/business/story/530331.html 

By BILL BOWEN
Star-Telegram staff writer
March 15, 2008

FORT WORTH -- The apparent ATM hacking of local bank accounts has spread 
to Naval Air Station Fort Worth, where as many as 200 service members 
have had money surreptitiously withdrawn from their accounts.

The scam may be a continuation of an ATM breach at OmniAmerican Bank, 
investigators said. Last week, employees at Lockheed Martin and Bell 
Helicopter with accounts at Fort Worth Community Credit Union saw their 
accounts tapped.

Naval air station officials have sent out e-mail alerts, and department 
leaders are warning their military members to watch their bank accounts 
carefully. The victims have accounts at financial institutions such as 
Bank of America, USAA and the Navy Federal Credit Union. The common link 
seems to be that all had used a OmniAmerican ATM on the base.

An OmniAmerican executive said that the bank has alerted Visa, through 
which the transactions seemed to have been accomplished.

"Even though our investigation is still ongoing, we have been in touch 
with Visa so that they can notify other financial institutions so that 
they can notify their customers through alerts," said Randi Mitchell, 
vice president of marketing at OmniAmerican.

Randy Noell said he was surprised when the Navy Federal Credit Union 
asked whether he was making purchases at a Victoria's Secret in 
Maryland.

"The credit union canceled my card, but not before it cost me about 
$830," said Noell, a petty officer first class with the base's military 
police.

About 30 people had been affected when authorities first became aware of 
the problem last week, said Don Ray, public-affairs officer for the 
base.

But that number has grown in recent days, said Noell, who has been 
taking statements from victims as he helps with the investigation. The 
matter has been referred to the Navy Criminal Investigative Service, 
base officials said.

None of the victims will be out of pocket, the credit union said.

OmniAmerican had its database hacked in January. The hackers, apparently 
operating from Eastern Europe, poked into "fewer than 100" accounts but 
prompted the bank to reissue 40,000 debit cards. The gang got account 
numbers and PINs, then created fake debit cards.


___________________________________________________      
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn