A federal jury convicted a Vladivostok, Russia, man of 38 counts related to an attack into point-of-sale computers to steal and sell credit card numbers, officials said.
Roman Valerevich Seleznev, aka Track2, 32, was found guilty after an eight-day trial of 10 counts of wire fraud, eight counts of intentional damage to a protected computer, nine counts of obtaining information from a protected computer, nine counts of possession of 15 or more unauthorized access devices and two counts of aggravated identity theft.
U.S. District Judge Richard A. Jones of the Western District of Washington scheduled sentencing for Dec. 2.
Between October 2009 and October 2013, Seleznev hacked into retail point-of-sale systems and installed malicious software (malware) to steal credit card numbers from various businesses from a server he operated in Russia, court documents said. Quite a few of the businesses were small businesses.
Evidence presented at trial demonstrated the malware would steal the credit card data from the point-of-sale systems and send it to other servers Seleznev controlled in Russia, the Ukraine or in McLean, Virginia. Seleznev then bundled the credit card information into groups called “bases” and sold the information on various “carding” websites to buyers who would then use the credit card numbers for fraudulent purchases, according to the trial evidence. Testimony at trial found Seleznev’s plan caused 3,700 financial institutions more than $169 million in losses.
When police took Seleznev into custody in July 2014 in the Maldives, his laptop contained more than 1.7 million stolen credit card numbers, some of which ended up stolen from businesses in Western Washington. The laptop also contained additional evidence linking Seleznev to the servers, email accounts and financial transactions involved in the scheme.
Seleznev is also facing charges in a separate indictment in the District of Nevada with participating in a racketeer influenced corrupt organization (RICO) and conspiracy to engage in a RICO, as well as two counts of possession of 15 or more counterfeit and unauthorized access devices.
Seleznev is also facing charges in the Northern District of Georgia with conspiracy to commit bank fraud, one count of bank fraud and four counts of wire fraud.
The U.S. Secret Service Electronic Crimes Task Force investigated the case. The task force includes detectives from the Seattle Police Department and the U.S. Secret Service Cyber Intelligence Section in Washington, D.C.