You are here

Justice News

Department of Justice
U.S. Attorney’s Office
District of New Jersey

FOR IMMEDIATE RELEASE
Tuesday, February 17, 2015

Russian National Charged in Largest Known Data Breach Conspiracy Extradited to Face Indictment in New Jersey

Defendant Brought From the Netherlands After Fighting Extradition for Over Two Years

NEWARK, N.J. – A Russian national appeared in Newark federal court today after being extradited from the Netherlands to face charges that he conspired in the largest international hacking and data breach scheme ever prosecuted in the United States, New Jersey U.S. Attorney Paul J. Fishman, U.S. Secret Service Acting Director Joseph P. Clancy and Assistant Attorney General Leslie Caldwell and announced.

Vladimir Drinkman, 34, of Syktyykar and Moscow, Russia, was arrested in the Netherlands on June 28, 2012, and charged in a scheme that targeted major corporate networks, stole more than 160 million credit card numbers, and resulted in hundreds of millions of dollars in losses. He had been detained by the Dutch authorities pending the resolution of the extradition proceedings.

He appeared today before U.S. Magistrate Judge James B. Clark III, entered a plea of not guilty to all 11 counts charged in the indictment and was ordered detained. Trial before U.S. district Judge Jerome B. Simandle is scheduled for April 27, 2015.

“Drinkman’s extradition on the indictment this office brought more than a year and a half ago shows how relentlessly we will pursue those who are charged with these serious crimes,” U.S. Attorney Fishman said. “The incredibly sophisticated work with our partners at the U.S. Secret Service to uncover this enormous, far-reaching scheme demanded an equal effort by our colleagues at the Department of Justice Criminal Division in Washington and our law enforcement partners overseas to bring the defendant back to face these charges.”

“This case demonstrates our commitment to fulfilling an important part of our integrated mission; that of protecting our Nation’s critical financial infrastructure,” Secret Service Acting Director Joseph P. Clancy said. “Our success in this investigation and other similar investigations is a credit to our skilled and relentless cyber investigators. Our determination, coupled with our network of foreign law enforcement partners, ensures that our investigative reach can expand beyond the borders of the United States.”

“Cyber criminals conceal themselves in one country and steal information located in another country, impacting victims around the world,” Assistant Attorney General Caldwell said.  “Hackers often take advantage of international borders and differences in legal systems, hoping to evade extradition to face justice.  This case and today's extradition demonstrates that through international cooperation, and through great teamwork between the Department of Justice and the Department of Homeland Security, we are able to bring cyber thieves to justice in the United States, wherever they may commit their crimes.”

Drinkman and four co-defendants allegedly sought corporate victims engaged in financial transactions, retailers that received and transmitted financial data and other institutions with information they could exploit for profit. The defendants are charged with attacks on NASDAQ, 7-Eleven, Carrefour, JCP, Hannaford, Heartland, Wet Seal, Commidea, Dexia, JetBlue, Dow Jones, Euronet, Visa Jordan, Global Payment, Diners Singapore and Ingenicard. It is not alleged that the NASDAQ hack affected its trading platform.

According to the second superseding indictment, unsealed in Newark federal court July 25, 2013, and other court filings:

The five defendants each served particular roles in the scheme. Drinkman and Alexandr Kalinin, 28, of St. Petersburg, Russia, each specialized in penetrating network security and gaining access to the corporate victims’ systems. Roman Kotov, 33, of Moscow, also a hacker, specialized in mining the networks Drinkman and Kalinin compromised to steal valuable data. The hackers hid their activities using anonymous web-hosting services provided by Mikhail Rytikov, 27, of Odessa, Ukraine. Dmitriy Smilianets, 31, of Moscow, sold the information stolen by the other conspirators and distributed the proceeds of the scheme to the participants.

Drinkman and Kalinin were previously charged in New Jersey as “Hacker 1” and “Hacker 2” in a 2009 indictment charging Albert Gonzalez, 33, of Miami, in connection with five corporate data breaches – including the breach of Heartland Payment Systems Inc., which at the time was the largest ever reported. Gonzalez is currently serving 20 years in federal prison for those offenses. Kalinin is also charged in two federal indictments in the Southern District of New York: One charges Kalinin in connection with hacking certain computer servers used by NASDAQ and the second indictment charges him and another Russian hacker, Nikolay Nasenkov, with an international scheme to steal bank account information from U.S.-based financial institutions. Rytikov was previously charged in the Eastern District of Virginia with an unrelated scheme.

Drinkman and Smilianets were arrested at the request of the United States while traveling in the Netherlands on June 28, 2012. Smilianets was extradited Sept. 7, 2012, and remains in federal custody. Kalinin, Kotov and Rytikov remain at large. All of the defendants are Russian nationals except for Rytikov, who is a citizen of Ukraine.

The Attacks

The five defendants conspired with others to penetrate the computer networks of several of the largest payment processing companies, retailers and financial institutions in the world, stealing the personal identifying information of individuals. They took user names and passwords, means of identification, credit and debit card numbers and other corresponding personal identification information of cardholders. Conservatively, the conspirators unlawfully acquired more than 160 millioncard numbers through hacking.

The initial entry was often gained using a “SQL injection attack.” SQL, or Structured Query Language, is a type of programing language designed to manage data held in particular types of databases; the hackers identified vulnerabilities in SQL databases and used those vulnerabilities to infiltrate a computer network. Once the network was infiltrated, the defendants placed malicious code, or malware, on the system. This malware created a “back door,” leaving the system vulnerable and helping the defendants maintain access to the network.  In some cases, the defendants lost access to the system due to companies’ security efforts, but were able to regain access through persistent attacks. 

Instant message chats obtained by law enforcement revealed the defendants often targeted the victim companies for many months, waiting patiently as their efforts to bypass security were underway. The defendants had malware implanted in multiple companies’ servers for more than a year.

The defendants used their access to the networks to install “sniffers,” which were programs designed to identify, collect and steal data from the victims’ computer networks. The defendants then used an array of computers located around the world to store the stolen data and ultimately sell it to others.

Selling the Data

After acquiring the card numbers and associated data – which they referred to as “dumps” – the conspirators sold it to resellers around the world. The buyers then sold the dumps through online forums or directly to individuals and organizations. Smilianets was in charge of sales, selling the data only to trusted identity theft wholesalers. He would charge approximately $10 for each stolen American credit card number and associated data, approximately $50 for each European credit card number and associated data and approximately $15 for each Canadian credit card number and associated data – offering discounted pricing to bulk and repeat customers. Ultimately, the end users encoded each dump onto the magnetic strip of a blank plastic card and cashed out the value of the dump by either withdrawing money from ATMs or making purchases with the cards.

Covering Their Tracks

The defendants used a number of methods to conceal the scheme. Unlike traditional Internet service providers, Rytikov allowed his clients to hack with the knowledge he would never keep records of their online activities or share information with law enforcement.

Over the course of the conspiracy, the defendants communicated through private and encrypted communications channels to avoid detection. Fearing law enforcement would intercept even those communications, some of the conspirators attempted to meet in person.

To protect against detection by the victim companies, the defendants altered the settings on victim company networks to disable security mechanisms from logging their actions. The defendants also worked to evade existing protections by security software.

*          *          *

As a result of the scheme, financial institutions, credit card companies and consumers suffered hundreds of millions in losses – including more than $300 million in losses reported by just three of the corporate victims – and immeasurable losses to the identity theft victims in costs associated with stolen identities and false charges.

The maximum potential penalties for each defendant per count are as follows:


Count(s)

Defendants

Violation

Maximum Penalty/Count

All

Conspiracy to gain unauthorized access to computers

5 years; $250,000 fine or twice the gain or loss from the offense

2

All

Conspiracy to commit wire fraud

30 years; $1 million fine or twice the gain or loss from the offense

3-8

Drinkman
Kalinin
Kotov
Smilianets

Unauthorized access to computers

5 years; $250,000 fine or twice the gain or loss from the offense

9-11

Drinkman
Kalinin
Kotov
Smilianets

Wire fraud

30 years; $1 million fine or twice the gain or loss from the offense

U.S. Attorney Fishman credited the special agents of the U.S. Secret Service, Criminal Investigations, under the direction of Acting Director Joseph P. Clancy, and special agents from the Newark Division, under the direction of Special Agent in Charge Carl Agnelli, for the ongoing investigation.

The government is represented by Gurbir S. Grewal, Chief of the U.S. Attorney’s Office Economic Crimes Unit, and Assistant U.S. Attorney Andrew S. Pak of the Computer Hacking and Intellectual Property Section of the Economic Crimes Unit, Trial Attorney Rick Green of the Criminal Division’s Computer Crime and Intellectual Property Section, and Judith Friedman of the Office of International Affairs.

U.S. Attorney Fishman thanked the Department’s Office of International Affairs in Washington for their extraordinary support, as well as public prosecutors with the Dutch Ministry of Security and Justice and the National High Tech Crime Unit of the Dutch National Police.

The charges and allegations contained in the indictment are merely accusations and the defendants are considered innocent unless and until proven guilty.

15-060                                               

Defense counsel:
Vladimir Drinkman: Florian Miedel Esq., New York; Bart Stapert Esq., Amsterdam, Netherlands
Dmitriy Smilianets: Andrey Tikhomirov Esq., Brooklyn, N.Y.

1
Updated September 14, 2015