Six people were indicted Wednesday in an international ring that took over more than 1,000 StubHub users’ accounts and fraudulently bought tickets that were then resold.
Manhattan District Attorney Cyrus R. Vance, Jr., today announced the indictment of six individuals in connection with an international cybercrime ring that was able to take over StubHub, LLC (“StubHub”) user accounts, steal personal identifying information, use victims’ credit cards to make fraudulent electronic ticket (“e-ticket”) purchases, and transfer the proceeds through a global network of accomplices in the United States, United Kingdom, Russia, and Canada. The defendants are charged in New York State Supreme Court with varying degrees of Money Laundering, Grand Larceny, Criminal Possession of Stolen Property, and Identity Theft, among other charges.1
“Cybercriminals know no boundaries – they do not respect international borders or laws,” said District Attorney Vance. “Today’s arrests and indictment connect a global network of hackers, identity thieves, and money-launderers who victimized countless individuals in New York and elsewhere. The coordinated actions of law enforcement officials in New York, New Jersey, the United Kingdom, and Canada demonstrate what can be achieved through international cooperation. I thank all of our partners, including the City of London Police, Royal Canadian Mounted Police, the United States Secret Service, and the NYPD for their integral assistance with this investigation.
“Regardless of where the case originates, nearly every cybercrime case begins with similar breaches: a stolen password, unauthorized use of a credit card, or unaccountable charges on a personal statement, for example. In this case, StubHub discovered evidence of fraud and immediately reported it to law enforcement. I encourage anyone who believes that he or she may have been the victim of identity theft to call my Office’s Cybercrime and Identity Theft hotline at 212-335-9600.”
City of London Police Commissioner Adrian Leppard said: “This represents a milestone in the working relationship we have developed with the New York County District Attorney’s Office to target what is truly international organized crime. This is an important investigation, targeting cyber criminals who are believed to have defrauded StubHub out of $1 million, by hacking its United States’ customers’ accounts to fraudulently purchase and sell tickets, and then laundered their criminal profits through legitimate UK bank accounts. The coordinated arrests in New York and London highlight how law enforcement will work globally to protect legitimate businesses and consumers from cyber-enabled fraud through the relentless pursuit of suspected criminals.”
Inspector Andrew Cowan, Officer in Charge of the Royal Canadian Mounted Police’s London Detachment, said: “Organized crime is an international problem that cannot be fought solely within our borders. As such, the RCMP is committed to work diligently with our international partners to combat organized crime in all its forms. This investigation is an excellent example of the success that can be achieved through strong international partnerships.”
Special Agent in Charge of the U.S. Secret Service New York Field Office Robert J. Sica said: “Our Electronic Crimes Task Force partnerships have proven remarkably successful in detecting and suppressing computer-based crime. The successes of these partnerships have proven that it remains difficult for criminals to remain anonymous. The Secret Service will continue to pursue new and innovative ways to combat emerging cyber threats.”
StubHub Director of Trust and Safety Eric Boyles said: “StubHub would like to thank the New York District Attorney’s Office, the New York Police Department as well as the many participating law enforcement agencies around the world for their efforts in investigating organized criminal activity targeting the event ticketing industry and consumers at large. We are pleased to see these cyber criminals brought to justice as part of StubHub’s continuing commitment to maintaining safe and open markets for fans to buy and sell tickets.”
According to the indictment, statement of facts, and documents and statements filed in court, in March 2013, StubHub, an eBay, Inc. subsidiary that operates a public website and digital marketplace for customers to buy and sell e-tickets to various entertainment events, discovered that more than 1,000 accounts were compromised by individuals who used the preexisting credit card information associated with the accounts to purchase tickets without the legitimate cardholders’ authorization. StubHub reported the fraud and immediately implemented security measures to prevent these intrusions, known as “Account Take-Over” fraud. However, investigators learned that the criminal ring was able to circumvent security protocols within the accounts by using new credit card information stolen from additional victims, instead of the original victims’ preexisting card information. After investigating the receipts and transaction records of more than 1,600 illegally accessed accounts, analysts in the DA’s Office were able to trace the exchanges to internet protocol addresses, PayPal accounts, bank accounts, and other financial accounts used and controlled by the indicted individuals.
VADIM POLYAKOV, 30, and NIKOLAY MATVEYCHUK, 21, are charged with using information taken from StubHub accounts and stolen credit card numbers to purchase more than 3,500 e-tickets that were sent to a group of individuals in New York and New Jersey to be resold within hours of an event. These events included some of New York’s most popular and sought-after events, such as concerts featuring Elton John, Marc Anthony, Justin Timberlake and Jay-Z; athletic events including Yankees baseball games, Giants and Jets football games, Knicks and Nets basketball games, Rangers hockey games, and the U.S. Open; and Broadway shows, such as Book of Mormon.
DANIEL PETRYSZYN, 28, LAURENCE BRINKMEYER, 29, and BRYAN CAPUTO, 29, are charged with reselling stolen tickets that they received from POLYAKOV and his associates. As instructed by POLYAKOV, criminal proceeds from the resale of stolen tickets were divided and directed to multiple PayPal accounts controlled by POLYAKOV and his associates, as well as multiple bank accounts in the United Kingdom and Germany.
One of these bank accounts belonged to SERGEI KIRIN, 37, a Russian national who advertised his money-laundering services online. POLYAKOV directed PETRYSZYN, BRINKMEYER, and CAPUTO to send payments to KIRIN, who retained a percentage of the money as his fee. Thousands of dollars were also split into separate payments and sent by wire transfer to other money-launderers in London, England and Toronto, Canada.
On July 1, the DA’s Office determined that Polyakov and a friend were traveling in Spain. Within hours of confirming his presence in the country, Interpol issued an international Red Notice for his arrest. Two days later, on July 3, Spanish authorities working with United States Secret Service agents arrested POLYAKOV outside of his hotel near Barcelona.
Today, investigators from the DA’s Office, NYPD, United States Secret Service, Bergen County, and Hudson County, executed search warrants in New York and New Jersey at the residences of PETRYSZYN, BRINKMEYER, and CAPUTO for additional evidence of their participation and involvement in the scheme.
Abroad, City of London Police detectives investigating what they suspect to be the proceeds of criminal activity being laundered through legitimate UK bank accounts arrested three men.2 The men, aged 27, 39, and 46, were arrested in London on suspicion of money laundering offenses and taken to local police stations for questioning. Royal Canadian Mounted Police (“RCMP”) also executed a search warrant and arrested an additional suspected money-launderer in Toronto.
The case represents the latest indictment in a series of investigations into international cyber-activity. In August 2013, the DA’s Office announced the convictions of 15 individuals indicted in connection with the Western Express cybercrime ring that extended from Ukraine to Brooklyn. The defendants were convicted of trafficking more than 95,000 stolen credit card numbers, resulting in more than $5 million in credit card fraud.
Consumer Protection Tips
Though cybercrime can seem pervasive and difficult to prevent, there are several precautions that individuals can take to help protect themselves and their assets. District Attorney Vance advises the following:
Monitoring your accounts daily for unusual activity
Never sharing your password
Frequently changing your passwords
Never using the same password for more than one site
Reporting any concerns to law enforcement.
New Yorkers who believe that they may be the victims of a cybercrime scheme or intrusion are advised to contact our Office’s Cybercrime and Identity Theft Bureau hotline at 212-335-9600.
Get updates from The Cardinal CRIME BLOG ‘Plus’ on Facebook. Just ‘LIKE’ the ‘Arlington Cardinal Crime & Forensics’ Page (become a fan of our page). The updates cover all posts in the 24/7 Crime Alerts! and sub-categories. See all of The Cardinal Facebook fan pages at Arlingtoncardinal.com/about/facebook …