The U.S. government has accused five men from Russia and Ukraine of one of the largest hacking schemes in the U.S., stealing 160 million credit card numbers and resulting in hundreds of millions of dollars in losses.
An indictment unsealed in a New Jersey federal court revealed criminal charges were first filed in 2009. The scheme purportedly began in 2005, lasting until the summer of 2012. The five men allegedly targeted more than a dozen American companies, including Nasdaq, J.C. Penney, as well as Visa Jordan Card Services (now known as Emerging Markets Payment), an independent company that processed payments using Visa’s network. More than $300 million was stolen from at least three companies.
The alleged hackers identified vulnerabilities within retail stores’ payment-processing systems and installed software on corporate computers to create back-door access. Stolen credit card numbers were then sold for $10 to $50 apiece.
Two defendants are in custody, while three remain fugitives. Four conspirators were also named in the charges.
Cybercrime costs the U.S. economy about $100 billion per year, according to a McAfee study released Monday. Though that sounds like a large figure, it’s a tenth of the government’s $1 trillion estimate in 2009.
Correction: An earlier version of this story listed Visa as one of the companies that was targeted. It was an independent third-party company that processed payments using Visa’s network.