U.S. charges eight hackers over alleged cyber theft of at least $15 million

By Jonathan Stempel

(Reuters) - Federal prosecutors in New Jersey on Wednesday unveiled criminal charges against eight people accused of trying to steal at least $15 million from U.S. customers in an international cybercrime scheme targeting accounts at 15 financial institutions and government agencies.

U.S. Attorney Paul Fishman said the conspiring hackers gained unauthorized access to computer networks, diverted customer funds to bank accounts and pre-paid debit cards and used "cashers" to make ATM withdrawals and fraudulent purchases in Georgia, Illinois, Massachusetts, New York and elsewhere.

Among the entities targeted were Automatic Data Processing Inc, Citigroup Inc, eBay Inc's PayPal, JPMorgan Chase & Co, TD Ameritrade Holding Corp and the U.S. Department of Defense, Fishman said.

The charges come as law enforcement officials crack down on cybercrime heists. This has included arrests announced last week of 11 people in the United States, United Kingdom and Vietnam in a worldwide credit card fraud ring, and a May raid on Liberty Reserve, a Costa Rica company that provided a "virtual currency" system to move money without using traditional banking.

The alleged ringleader of the latest scheme was Oleksiy Sharapka, 33, of Kiev, Ukraine, who was helped by Leonid Yanovitsky, 38, also of Kiev, according to federal prosecutors.

Other defendants are Oleg Pidtergerya, 49, of Brooklyn, New York; Robert Dubuc, 40, of Malden, Massachusetts and Andrey Yarmolitskiy, 41, of Atlanta, who prosecutors said managed crews in their respective areas.

Richard Gundersen, 46, of Brooklyn and Lamar Taylor, 37, of Salem, Massachusetts, were accused of working for Pidtergerya and Dubuc, respectively, while Ilya Ostapyuk, 31, of Brooklyn, allegedly helped move fraud proceeds, court papers show.

In a court filing a Secret Service agent described the scheme, including an email about an ultimately thwarted transfer from an ADP account, where Sharapka told Dubuc: "You can do the same thing with the rest of the regular cards, so I can activate them and start giving them to guys to put money on, because we are losing time again."

"MODERN-DAY BANK ROBBERIES"

Prosecutors charged the eight defendants with three conspiracy counts: wire fraud, money laundering and identity theft. Each defendant faces as much as 20 years in prison on the first two counts and up to 15 years on the third.

"Cybercriminals penetrated some of our most trusted financial institutions," Fishman said in a statement. "Today's charges and arrests take out key members of the organization, including leaders of crews in three states that used those stolen identities to 'cash out' hacked accounts in a series of internationally coordinated modern-day bank robberies."

Fishman said Dubuc, Ostapyuk, Pidtergerya and Yarmolitskiy were arrested this week, Gunderson and Taylor are being pursued and Sharapka and Yanovitsky remain at large.

Igor Niman, a lawyer for Ostapyuk, declined immediate comment. Lawyers for the other defendants could not be located.

ADP and TD Ameritrade said they have worked with law enforcement on the matter, and that their respective systems were not breached. TD Ameritrade also said its case involved a client whose credentials had been obtained outside its network.

The Department of Defense had no immediate comment. Citigroup, JPMorgan and PayPal did not immediately respond to requests for comment.

The case is U.S. v. Sharapka et al, U.S. District Court, District of New Jersey, No. 13-mag-06089.

(Reporting by Jonathan Stempel in New York; Editing by Gerald E. McCormick and Andre Grenon)

["Stock Photo: Hacker Stealing Data From A Computer" on Shutterstock]