Finally good news on the identity theft prevention front. Eleven perpetrators involved in an international identity theft ring that compromised 9 major US retailers have been charged with numerous offenses including conspiracy, fraud and identity theft. Of those indicted on charges, only 3 were American with the other 8 coming from Estonia, Ukraine, Belarus and China. Together, they were responsible for the sale of more than 40 million debit and credit card numbers. This is the same group responsible for the data breaches at TJX Companies(T.J. Maxx), Barnes & Noble, BJ’s Wholesale Club, OfficeMax, Sports Authority, Forever 21, Boston Market and DSW. The three year investigation involved numerous government departments including the U.S. Secret Service, Department of Justice, the Internal Revenue Service Criminal Investigation Division, the Criminal Division’s Office of International Affairs and numerous U.S. Attorney offices.
What seems odd about this identity theft ring is its international flavor and non-existing ties to larger criminal organizations. One has to wonder how these 11 people hooked up, though it may easily be explained by their participation in one of many black market internet sites that routinely sell credit and debit cards, Social Security numbers, and bank account information. See the Dateline MSNBC video To Catch an ID Thief on our homepage for more on this.
Furthermore, this was not a very tech operation. They received access to these companies by driving around looking for unprotected wireless connections. They didn’t need an expert hacker, they just uploaded “sniffer†programs that captured all the debit, credit and bank account information as well as the passwords that went along with them. They then loaded blank cards with the debit or credit card information and started withdrawing funds. It is unclear how much they received in total but the indictment of one identity thief alleges he received proceeds from crime exceeding $11 million.
Three of the thieves were also charged in a separate indictment for the data breach at Dave & Buster’s restaurant chain in which 5,000 credit and debit cards were compromised resulting in losses of $600,000 to the financial institutions involved. Can you imagine the losses they received for the 97 million card numbers captured in the T.J. Maxx fiasco. Now you know why the banks sued and TJX Companies settled out of court. The VISA settlement alone was for $40.9 million and without doubt it opened the eyes of companies and organizations across America and spurred them to protect their wireless communications. Unfortunately, data breaches still continue daily from hackers, lost and stolen laptops or backup tapes, and due to employee or corporation incompetence.
It is amazing that 11 criminals from around the world can do so much damage to the American economy. If identity theft isn’t addressed further by individuals and corporations the cost to the American economy, pegged at about $50 Billion a year, will continue to have devastating results. Governments can only do so much. Americans themselves must pressure those who we entrust with our private information to take all security precautions. As it stands now financial decisions are taking place that prevent full security procedures from being implemented. Unfortunately this will continue to cost all of us, and will cause undue hardship and stress to many of the 10 million innocent people who will fall victim to identity theft this year and every year. Are you doing all you can to protect you family?