Cyber-Criminals Steal $45 Million, Ship It Off In Suitcases Full Of Cash

Since the dawn of the connected computer age, criminals in movies have easily transferred massive amounts of stolen money via computer — often while an onscreen “transaction processing” bar slowly indicates the progress of the crime. But when real-life cyber-criminals want to pay off their ringleader, they apparently do so the old-fashioned way, with a suitcase full of cash sent on a bus.

This is according to the U.S. Attorney’s Office for the Eastern District of New York, which today announced the arrest of five men allegedly connected to a complicated “cyberheist” that took $45 million in just a matter of hours earlier this year.

(Side Note: Does anyone else feel really old and out-of-touch using the “cyber” prefix? It makes me think of that horrendous 1993 Billy Idol album.)

The suspects are accused of being members of a NY-based cell of a global crime network that hacked into financial institutions’ servers to steal prepaid debit card data and then withdraw all that money from ATMs around the world.

The prosecutors say they have photos of $800,000 of the boosted cash packed in a suitcase shipped via bus to Florida to the group’s organizer.

The suspects are being charged in federal court with conspiracy to commit access device fraud.

“As alleged, just a few months ago, after exploiting cyber-weaknesses in the financial system to steal millions from ATMs, these defendants were packing bags to the brim with stolen cash, destined for the cybercriminal organizers of these attacks,” stated United States Attorney Loretta Lynch. “Today, we have sent them packing once again – but this time, to jail. We will not relent until all those responsible for these financially devastating cybercrimes are brought to justice.”

The defendants are accused [PDF] of participating in at least two huge heists, the first, against UAE-based RAKBANK, occurred in Dec. 2012. Hackers stole info on more than 4,500 prepaid debit cards, and around $5 million was withdrawn by people in 20 different countries.

The second attack was much, much larger. In February, these hackers allegedly breached the systems of Bank Muscat in Oman. In the course of only 10 hours, participants in 24 countries withdrew $40 million from ATMs with stolen info about the bank’s prepaid debit cards.

The man arrested in New York are accused of withdrawing a total of $2.8 million at over 140 different ATM locations in New York City. They then packed this money up and shipped it to the ringleaders around the world.

Of course, they took photos of the money. One image, seized from a defendant’s iPhone, allegedly shows $800,000 taken from the Bank Muscat heist before it was sent on the bus to Florida. The recipient is believed to have fled to the Dominican Republic.