3 Charged In Cyberattacks Against US Finance Companies
NEW YORK (CBSNewYork/AP) -- Two men held in Israel and one U.S. citizen believed to be living in Moscow have been charged in the largest theft of consumer data from a U.S. financial institution in history, according to an indictment unsealed Tuesday.
Most of the theft of personal information from more than 100 million customers came with a summer 2014 attack against JPMorgan Chase & Co., the nation's biggest bank by assets, prosecutors in New York said.
According to the indictment, the men stole customer records of more than 83 million customers of JPMorgan Chase & Co. from June 2014 to August 2014. The court papers said identifying information on millions of other people was stolen in cyberattacks from 2012 to last summer against several other financial institutions, financial services corporations and financial news publishers.
"Today, we have exposed a cybercriminal enterprise that for years successfully and secretly hacked into the networks of a dozen companies, stealing the personal information of over a hundred million people," U.S. Attorney Preet Bharara said during a Manhattan news conference.
The indictment said one or more of the defendants also engaged in other criminal schemes since 2007, including U.S. securities market manipulation schemes and the operation of at least a dozen Internet casinos that violated U.S. laws.
It also said some of the massive computer hacks and cyberattacks occurred as the men sought to steal the customer base of competing Internet gambling businesses or to secretly review executives' emails in a quest to cripple their rivals.
"The investigation essentially started with one victim company and one hack," Bharara said. "And as we dug deeper and used all the investigative tools at our disposal, we were able to unearth the gargantuan scheme that you see in the charges unsealed today."
Charged in the indictment were Gery Shalon, Ziv Orenstein and Joshua Samuel Aaron. All three men were charged in July with related crimes, though the hacking crimes were not specified then.
As CBS2's Dick Brennan reported, authorities said Aaron, a U.S. citizen believed to be residing in Moscow and Israel, was a fugitive while Shalon, of Savyon, Israel, and Orenstein, of Bat Hefer, Israel, were in custody in Israel. Among charges in the indictment were computer hacking, conspiracy to commit computer hacking, securities fraud and conspiracy to commit securities fraud.
A lawyer for Orenstein did not immediately return a message seeking comment. A lawyer for Shalon could not immediately be reached.
Austin Berglass of K2 Intelligence headed up the FBI's investigation into the JP Morgan Breach.
"These are not your traditional hackers. These aren't the very sophisticated hackers sitting over in Eastern Europe," he said, "These are fraudsters, criminals who most likely need the assistance of someone more technical in order to accomplish these sophisticated hacks."
Prosecutors described a complex scheme in which the suspects pumped up the value of penny stocks by sending spam emails to addresses stolen in the hackings. They then dumped the stocks at inflated prices, making tens of millions in illegal profits.
"In our view the conduct alleged in this case showcases a brave new world of hacking for profit," Bharara said,
Experts said if your personal information was hacked, you will be alerted.
"The company is mandated to notify you," Berglass said.
If only your emails were stolen, you won't necessarily be notified, but you are still at risk. If hackers have your email they can send you an attachment that's really a virus. If you click on it they have the keys to everything.
(TM and © Copyright 2015 CBS Radio Inc. and its relevant subsidiaries. CBS RADIO and EYE Logo TM and Copyright 2015 CBS Broadcasting Inc. Used under license. All Rights Reserved. This material may not be published, broadcast, rewritten, or redistributed. The Associated Press contributed to this report.)