DOJ cracks $9m fraud ring

The Department of Justice has indicted eight individuals of the RBS attack

The US Department of Justice (DOJ) has indicted eight individuals in what authorities claim to be a $9m (£5.37m) bank hacking operation.

A federal grand jury based in Atlanta, Georgia issued the indictments after authorities presented evidence of the alleged breach at the Atlanta offices of Royal Bank of Scotland's RBS WorldPay branch.

The four main suspects on the case include three alleged hackers based in Estonia, Russia, Moldova and a fourth unnamed suspect labelled "Hacker 3". Each of the four has been charged with 16 criminal counts including wire fraud, identity theft, conspiracy and access device fraud.

Additionally, the grand jury issued indictments for four additional Estonian residents on charges of access device fraud.

According to the DOJ, the group was able to compromise encryption protections to access data on a number of debit cards within the RBS WorldPay automatic payroll system.

Details on the compromised accounts were then used to increase credit limits and create 44 counterfeit debit cards. The counterfeit cards were then sent around the world to a number of money mules, each of whom accessed the accounts through local ATMs and sent as much as 70 per cent of the money back to the hackers.

The DOJ estimates that the entire withdrawal run took place over a span of 12 hours and resulted in a total of $9m being withdrawn from 2,100 ATM machines.

"This investigation has broken the back of one of the most sophisticated computer hacking rings in the world," declared US district attorney Sally Quillian Yates.

"Last November, in just one day, an American credit card processor was hacked in perhaps the most sophisticated and organised computer fraud attack ever conducted. Today, one year later, the leaders of this attack have been charged. "