Feds Bust Hacking Ring Accused of Stealing Millions

WASHINGTON — A U.S. grand jury indicted eight foreigners on charges that they hacked a computer network used by the credit card processing company RBS WorldPay and stole more than $9 million, the U.S. Justice Department said Tuesday.

The group, which included people from Estonia, Russia and Moldova, was accused of compromising the data encryption used by RBS WorldPay, based in Atlanta and part of Royal Bank of Scotland, and gaining access to accounts a year ago.

"This investigation has broken the back of one of the most sophisticated computer-hacking rings in the world," said Sally Quillian Yates, the acting U.S. attorney for northern Georgia.

RBS WorldPay is one of the leading payment processing businesses globally.

U.S. cybersecurity officials long have been worried about hacks into global financial networks that could harm the financial system.

This indictment marked the latest in a series of cases that have highlighted the risk to such networks. It comes about two months after a 28-year-old computer hacker from Miami pleaded guilty to charges that he helped lead a worldwide ring that stole more than 40 million credit and debit card numbers.

The Justice Department Tuesday identified the accused in this latest case as five Estonians, one Russian, one Moldovan and one individual whose nationality was not specified.

They were indicted by a grand jury in Atlanta, and Estonian authorities have arrested four of them, the Justice Department said. One of the accused, Sergei Tsurikov of Estonia, already is awaiting extradition to the United States.

The ring was charged with hacking data for payroll debit cards, which enable employees to withdraw their salaries from automated teller machines. Those accused in the case allegedly raised the limits on some cards so they could withdraw the money, the U.S. government said.

More than $9 million was withdrawn in less than 12 hours from more than 2,100 ATMs around the world, the Justice Department said, adding that RBS WorldPay immediately reported the breach once it was discovered.

The firm said it was cooperating with the agencies involved in the investigation and declined further comment because "the criminal investigation is ongoing."

RBS WorldPay is part of global merchant services, one of the assets that Royal Bank of Scotland is being forced to sell to satisfy EU antitrust concerns over state aid it has received.

RBS, which will be 84 percent state-owned after a fresh bail-out deal agreed to last week, is one of the top recipients of state aid. It has up to four years to sell the assets.