How a cyberthief "captured" a credit union
One of the suspects in a global cybercrime spree that allegedly resulted in the theft of personal data belonging to 100 million people also "captured" and controlled a federal credit union in Jackson, New Jersey, according to federal prosecutors.
Government regulators last month put the Helping Other People Excel Federal Credit Union, which serves low-income families, in conservatorship. The credit union's daily operations were assigned to Pinnacle Federal Credit Union in Edison, New Jersey, according to the National Credit Union Administration (NCUA) and to a recorded phone message at the Jackson credit union.
In July, federal prosecutors announced the indictment of Anthony R. Murgio, 31, of Tampa for masterminding an illegal money laundering operation that facilitated ransom payments made by hacking victims whose computers had been commandeered by malware dubbed "Cryptowall." Prosecutors say Murgio used a phony sports memorabilia Internet marketing firm and the Jackson credit union to launder payments made in bitcoin, a type of peer-to-peer virtual money, into cash.
Also charged in July was Yuri Lebedev, 37, of Jacksonville, Florida. At the time, Murgio was released on $100,000 bail and Lebedev on $25,000. The identity of the Jackson credit union, which still has not been disclosed by prosecutors, surfaced in The New York Times in July when the original charges were filed.
According to prosecutors, in April 2014 Murgio reached out to an unnamed senior executive with the New Jersey credit union. They say Murgio was able to take control of the institution by stacking the institution's board of directors with unnamed co-conspirators in exchange for $100,000. From October 2013 until July of this year, prosecutors say, Murgio was able to exchange millions of dollars for bitcoins.
The link between the July indictment and this week's case involving an alleged pump-and-dump stock scheme and illegal online casinos, was Coin.mx. That's the illegal U.S. bitcoin exchange owned by Gery Shalon, who was charged this week, and Murgio, who allegedly ran the operation in the U.S.
The broader global conspiracy, which prosecutors say represents the largest theft of consumer data from a U.S. financial institution in history, involves hundreds of millions of dollars and 75 shell corporations. Among the dozen companies that were hacked were JPMorgan Chase (JPM), Dow Jones (NWSA), E*Trade (ETFC) and Scottrade.
The Helping Other People Excel Federal Credit Union was founded in 1978 and has just 96 members with close to $300,000 in assets, according to the NCUA. The charging documents' timeline indicates that sometime earlier this year, the NCUA detected the illegal activity and ordered the credit union to close down the illicit operation.
NCUA charters both state and federal credit unions. Of the 6,100 federally insured credit unions, almost 1,900, a little over 30 percent, have assets of less than $10 million. The average credit union holds $190 million dollars in assets.
Credit unions are member-owned financial nonprofit cooperatives that are governed democratically by their members.
"Starting a credit union requires applying for a charter and for insurance," said John Fairbanks with the NCUA. "That process includes careful scrutiny to determine whether the proposed credit union will have the staff skill and experience, as well as the capital and institutional capacity, to serve its field-of-membership, the people it purports to serve."
Credit unions do not serve the general public. "Membership is defined in one of several ways, including where people work, or a church or other organization they belong to. Or, in the case of a community charter, where they live," Fairbanks told CBS MoneyWatch.
According to the NCUA, 91 credit unions have been closed and 24 put in conservatorship since 2009. Over the same period, Bankrate reports that 488 U.S. banks were closed.