Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


02:58 PM

Men Accused Of Hacking Restaurant Credit Card System

The U.S. Attorney's office says the men installed packet sniffers to capture credit card data as it flowed through the restaurant chain's computer systems.

A federal grand jury has indicted three men accused of stealing credit and debit card numbers from customers at a national restaurant chain.

A 27-count indictment returned in Central Islip, N.Y. accuses Maksym Yastremskiy of Ukraine and Aleksandr Suvorov of Estonia of wire fraud conspiracy, wire fraud, conspiracy to possess unauthorized access devices, access device fraud, aggravated identity theft, conspiracy to commit computer fraud, computer fraud, and interception of electronic communications. A second indictment charges Albert Gonzalez of Miami with wire fraud conspiracy in the same scheme.

The U.S. Attorney's Office for the Eastern District of New York and the criminal division's computer crime and intellectual property section said Maksym Yastremskiy, also known as "Maksik," Aleksandr Suvorov, also known as "JonnyHell," and Albert Gonzales, also known as "Segvec," hacked into cash register terminals at 11 Dave & Buster's restaurants in the United States. The defendants are accused of selling the data to others for fraudulent purchases or resale.

They are accused of pulling off the theft with only "Track 2 data," which includes customers' account numbers and expiration dates, but not the cardholders' names or other personally identifiable information.

The indictment states that Yastremskiy and Suvorov installed packet sniffers to capture data as it flowed from the restaurants' point-of-sale servers through the computer system at the company's corporate headquarters to a data processor last year. The court records state that the defendants obtained data from about 5,000 credit and debit cards through one restaurant, and caused losses of at least $600,000 to the financial institutions that issued the cards.

Turkish officials arrested Yastremskiy in Turkey last year and he remains in jail on potential violations of Turkish law. The U.S. has requested his extradition.

German officials arrested Suvorov in March while he was visiting that country. He also remains in jail, pending German action on a U.S. extradition request. U.S. Secret Service officials arrested Gonzalez in Miami this month.

"This case demonstrates the potential for criminals to inflict significant damage to our nation's financial sector, but this investigation and the resulting indictments should serve as a warning to cybercriminals that law enforcement will continue to pursue them wherever they are," U.S. Secret Service director Mark Sullivan said in a news announcement.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Intel Issues Fix for 'Plundervolt' SGX Flaw
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/11/2019
Register for Dark Reading Newsletters
White Papers
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
PUBLISHED: 2019-12-13
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board m...