Eight members of a Ukrainian cybercrime ring are now facing charges after illegally access the networks of a number of financial institutions including Citibank, JP Morgan Chase, TD Ameritrade and PayPal, along with the U.S. Department of Defense’s Finance and Accounting Services service, federal officials said.
The gang stole in excess of $15 million via money laundering and identity theft after extracting customer account information from 15 different payment processors, banks and online brokers, said New Jersey U.S. Attorney Paul J. Fishman.
The two ringleaders, Oleksiy Sharapka, 33, and Leonid Yanovitsky, 38, both of Kiev, Ukraine, remain at large, according to reports. Sharapka had previously been in custody in Massachusetts and served a 102-month federal sentence from 2004 to 2012 before officials deported him to Ukraine last spring, according to prosecutors in New Jersey.
While primarily based in Ukraine, the ring extended to New York City, Atlanta and two towns on the outskirts of Boston.
Oleg Pidtergerya, 49, of Brooklyn, NY; Robert Dubuc, 40, of Malden, MA; Andrey Yarmolitskiy, 41, of Atlanta, Richard Gunderson, 46, of Brooklyn, and Lamar Taylor, 37, of Salem, MA., face charges of three counts of conspiracy, one for wire fraud, one for money laundering and one for identity theft. While police arrested Pidtergerya, Ostapyuk and Dubuc in Brooklyn and Malden on Wednesday, Yarmolitskiy ended up arrested when he flew into John F. Kennedy International Airport Tuesday.
Police are still hunting for the two remaining co-conspirators, Gunderson and Taylor.
From March 2012 to June 2013, the suspects hacked into the servers of banks, secured customers’ information and funneled money from legitimate bank accounts to prepaid debit cards. “Cashers” in the U.S. cashed out the accounts via ATMs and by making fake purchases as part of what the federal complaint refers to as the “Sharapka Cash Out Organization.”
According to the complaint, the conspirators also defrauded the IRS by faking tax returns in the names of the identity theft victims. The ring received about $20,000 in fake tax refunds from June to July, 2012.
Fifteen companies were victims in the case, including Aon Hewitt, Automated Data Processing Inc., Citibank N.A., E-Trade, Electronic Payments Inc., Fundtech Holdings LLC, iPayment Inc., JP Morgan Chase Bank N.A., Nordstrom Bank, PayPal, TD Ameritrade, the U.S. Department of Defense’s Defense Finance and Accounting Service, TIAA-CREF, USAA, and Veracity Payment Solutions Inc.