Huge cyber bank theft spans 27 countries

By Jessica Dye, Joseph Ax and Jim Finkle

NEW YORK/BOSTON (Reuters) - In one of the biggest ever bank heists, a global cyber crime ring stole $45 million from two Middle Eastern banks by hacking into credit card processing firms and withdrawing money from ATMs in 27 countries, U.S. prosecutors said on Thursday.

The U.S. Justice Department accused eight men of allegedly forming the New York-based cell of the organization, and said seven of them have been arrested. The eighth, allegedly a leader of the cell, was reported to have been murdered in the Dominican Republic on April 27.

The ringleaders are believed to be outside the United States but prosecutors declined to give details, citing the ongoing investigation. What's clear is the sheer scope and speed of the crimes: in one of the attacks, in just over 10 hours, $40 million was raided from ATMs in 24 countries involving 36,000 transactions.

"In the place of guns and masks, this cyber crime organization used laptops and the Internet," U.S. Attorney for the Eastern District of New York Loretta Lynch said at a news conference. "Moving as swiftly as data over the Internet, the organization worked its way from the computer systems of international corporations to the streets of New York City."

The case demonstrates the major threat that cyber crime poses to banks around the world. It also shows how increasingly international and sophisticated criminal gangs have become, particularly those using the Internet.

Prosecutors highlighted the "surgical precision" of these hackers, the global nature of their organization, and the speed and coordination with which they executed operations in 27 countries.

According to the complaint, the gang broke into the computers of two credit card processors, one in India in December 2012 and the other in the United States this February. The companies were not identified.

The hackers increased the available balance and withdrawal limits on prepaid MasterCard debit cards issued by Bank of Muscat of Oman, and National Bank of Ras Al Khaimah PSC (RAKBANK) of the United Arab Emirates, according to the complaint. They then distributed counterfeit debit cards to "cashers" around the world, enabling them to siphon millions of dollars from ATMs in a matter of hours.

In New York, for example, members of the cell fanned out into the city on the afternoon of February 19, armed with cards bearing a single Bank of Muscat account number. Ten hours later, they had completed 2,904 withdrawals for $2.4 million in all, the final transaction coming around 1:26 a.m., prosecutors said.

Casher crews in other countries were busy doing the same, pulling some $40 million from Bank of Muscat to add to the $5 million they stole from RAKBANK in December, according to the indictment. In total, cashers made some 40,500 withdrawals in 27 countries during the two coordinated incidents.

Prosecutors said the method of attack was known as "Unlimited Operations" in the cyber underworld.

Representatives for the two banks could not be reached for comment outside of regular business hours.

In a statement, Mastercard said it had cooperated with law enforcement in the investigation and stressed that its systems were not involved or compromised in the attacks.

In late February, Bank Muscat disclosed that it would take an impairment charge of up to 15 million rials ($39 million) because it had been defrauded overseas by 12 prepaid debit cards used for travel. That charge was equal to more than half of the 25 million rials profit it posted in its first quarter ended March 31.

HIGHLY SKILLED HACKERS

Cyber experts said they believe the operation likely required the work of several hundred people, at least several of whom were highly skilled hackers capable of devising ways to penetrate well-protected financial systems.

"Hackers only need to find one vulnerability to cause millions of dollars of damage," said Mark Rasch, a former federal cyber crimes prosecutor, based in Bethesda, Maryland.

The group may have targeted Middle Eastern banks because they tend to allow customers to put much larger sums on cards and do not monitor them as closely as banks in other regions, said Shane Shook, global vice president of consulting for the security firm Cylance Inc.

"It's a target-rich environment in terms of soft electronic security," said Shook, an Arabic speaker who has spent more than a decade investigating cyber crimes.

The case is similar to one in 2009 that targeted the prepaid debit-card unit of Royal Bank of Scotland, which lost more than $9 million in less than 12 hours, said Jason Weinstein, a former federal prosecutor who supervised the Justice Department's handling of that case.

That case was considered a watershed moment in cyber crime prosecutions at the time. "This dwarfs that case," he said.

It is not clear if banks can seek to recover losses from card processors, legal experts said. Contracts usually have specific language governing the security protocols that must be in place, said Frederick Rivera, an attorney with Perkins Coie who specializes in financial services litigation.

If the processors failed to follow those requirements, they could be liable for the losses. If they had adequate security, however, the banks "could be left holding the bag," Rivera said.

The banks might also be able to seek reimbursement under their insurance policies, many of which now have cyber crime provisions, or from the processors' insurance carriers.

Weinstein also said that the processors could face regulatory scrutiny over whether they provided proper security.

The eight defendants - all U.S. citizens and residents of Yonkers, New York - were charged with withdrawing cash from the ATMs and transporting money, not hacking into the credit card processing firms or managing the operation.

The seven arrested are: Jael Mejia Collado, Joan Luis Minier Lara, Evan Jose Peña, Jose Familia Reyes, Elvis Rafael Rodriguez, Emir Yasser Yeje and Chung Yu-Holguin (known as "Chino El Abusador"). All except for Rodriguez were arraigned on Thursday and pleaded not guilty. Rodriguez's attorney was unavailable. Only Pena has been released on bail.

The defendant who reportedly had been killed was Alberto Yusi Lajud-Peña, also known as "Prime" and "Albertico." Lynch said it was unclear whether the murder was related to this case.

Prosecutors said cashers often laundered their proceeds by purchasing luxury goods, and sending a portion of the money back to the organization's leaders.

Lynch said the New York gang kept roughly 20 percent of their takes, and sent the rest to the organizers. Authorities said they seized hundreds of thousands of dollars in cash and bank accounts, as well as two Rolex watches and a Mercedes SUV, from the defendants.

Investigators said that they found an email exchange with an account associated with a criminal money laundering operation in St. Petersburg, Russia, describing wire transfers.

An investigation is ongoing to see if other cells are operating in the country, Lynch said, adding that U.S. law enforcement had worked with counterparts in Japan, Canada, Germany, Romania, the United Arab Emirates, Dominican Republic, Mexico, Italy, Spain, Belgium, France, United Kingdom, Latvia, Estonia, Thailand, and Malaysia to uncover the ring.

No individual bank accounts were compromised by the scheme, Lynch said.

The case is U.S. v. Lajud-Pena et al., U.S. District Court, Eastern District of New York, No. 13-cr-259.

(Editing by Noeleen Walder, Tiffany Wu, Leslie Gevirtz and Phil Berlowitz)

View the original article here

Exclusive: At Texas fertilizer plant, a history of theft, tampering

By Selam Gebrekidan and Joshua Schneyer

NEW YORK (Reuters) - The Texas fertilizer plant that exploded two weeks ago, killing 14 people and injuring about 200, was a repeat target of theft by intruders who tampered with tanks and caused the release of toxic chemicals, police records reviewed by Reuters show.

Police responded to at least 11 reports of burglaries and five separate ammonia leaks at West Fertilizer Co over the past 12 years, according to 911 dispatch logs and criminal offense reports Reuters obtained from the McLennan County Sheriff's office in Waco, Texas through an Open Records Request.

Some of the leaks, including one reported in October 2012, were linked to theft or interference with tank valves.

According to one 2002 crime report, a plant manager told police that intruders were stealing four to five gallons of anhydrous ammonia every three days. The liquid gas can be used to cook methamphetamine, the addictive and illicit stimulant.

In rural areas across the United States, the thriving meth trade has turned storage facilities like West Fertilizer Co and even unattended tanks in farm fields into frequent targets of theft, according to several government and fertilizer industry reports issued over the past 13 years.

The cause of the April 17 blast at the plant in the town of West is still being probed, and investigators have offered no evidence that security breaches contributed to the deadly incident. There also is no indication that the explosion had anything to do with the theft of materials for drug making. Anhydrous ammonia has been ruled out as a cause because the four storage tanks remained intact after the blast, said Rachel Moreno, a spokeswoman for the Texas Fire Marshal's Office.

MANY LEADS

Investigators are pursuing about 100 leads, including a call to an arson hotline and a tip that there had been a fire on the property earlier on the day of the explosion, according to Moreno. Authorities have not said whether either tip was credible. About 80 investigators from various state and federal agencies are contributing to the probe. They hope to determine by May 10 what caused the explosion, Texas Fire Marshal Chris Connealy said at a state legislative hearing on Wednesday.

A spokesman for the U.S. Department of Homeland Security (DHS), one of several state and federal agencies that monitor security at chemical plants, declined to answer questions about the breaches of security at West Fertilizer Co. State investigators also declined to comment.

Thefts of anhydrous ammonia are common in McLennan County, where burglars siphon fertilizer from trailer tanks into five-gallon propane containers, said McLennan County Chief Deputy Sheriff Matt Cawthon, who took up the position in January.

After reviewing crime reports from the past 12 years and speaking to deputies who responded to some of the break-ins, Cawthon said security was clearly lax at the plant.

The perimeter was not fenced, and the facility had no burglar alarms or security guards, he said. "It was a hometown-like situation. Everybody trusts everybody."

Chemical safety experts said the recurrent security breaches at West Fertilizer are troubling because they suggest vulnerability to theft, leaks, fires or explosions. Apart from anhydrous ammonia, the company stored tons of ammonium nitrate, a fertilizer that can be used in bomb-making. No thefts of that substance were reported to police.

"Regardless of what triggered this specific event, the fact that there were lots of burglaries and that they were after ammonia clearly shows this plant was vulnerable to unwanted intruders or even a terrorist attack," said Sam Mannan, a chemical process safety expert at Texas A&M University, who has advised Dow Chemical and others on chemical security.

NEW LAW

Owners of West Fertilizer, responding through a representative, declined to answer questions about specific instances of theft or the level of security at the plant. The company has encouraged its employees to share "all they know" with investigators, said Daniel Keeney, a spokesman for the company.

The current owners of West Fertilizer are Donald Adair, 83, and Wanda Adair, 78, who bought it in 2004. Calls to a number listed for previous owner Emil Plasek were not returned.

In a 2006 permit application with the Texas Commission on Environmental Quality (TCEQ), the company reported it would protect ammonia tanks against theft or tampering and conduct daily equipment inspections. A TCEQ spokesman would not comment about security measures. He said the agency's responsibility is to regulate emissions from the plant, not to oversee security.

Documents from the Texas Department of State Health Services show the West plant was storing 540,000 pounds of ammonium nitrate and 54,000 pounds of anhydrous ammonia in 2012. Ammonium nitrate was among the ingredients in the bomb used by Timothy McVeigh to blow up the Oklahoma City federal building in 1995, killing 168 people.

After that bombing, Congress passed a law requiring facilities that store large amounts of the chemical to report to the DHS and work with the agency to ensure proper security measures are in place to keep it out of criminal hands and protect against such attacks.

West Fertilizer did not report to DHS, despite storing hundreds of times more ammonium nitrate than the amount that would require it do so. Depending on the grade of the chemical, companies are required to report if they store at least 400 pounds or 2,000 pounds of ammonium nitrate.

A 2005 U.S. Centers for Disease Control and Prevention (CDC) study identified hundreds of cases in 16 states where anhydrous ammonia was stolen for use in meth production. Some illegal labs mix anhydrous ammonia with ephedrine or pseudoephedrine and sodium or lithium to make methamphetamine, the U.S. Department of Justice reported in 2001.

In dozens of instances, the CDC said, the thefts by meth makers siphoning ammonia from tanks caused injuries or forced evacuations because gas was released into the environment. However, cases of ammonia theft have become less frequent since 2006, when new laws restricted the sale of pseudoephedrine, which is found in some common cold drug remedies, according to The Fertilizer Institute, an industry association.

Police records show West Fertilizer began complaining of repeated thefts from the facility in June 2001, when burglars stole 150 pounds of anhydrous ammonia from storage tanks three nights in a row. Nearly a year later, a plant manager told police that thieves were siphoning four-to-five gallons of the liquefied fertilizer every three days.

Randy Plemons, who was chief deputy sheriff during the years when the thefts occurred, declined to discuss specifics of his agency's response to the repeated break-ins.

"Whenever we were notified of the burglaries and thefts we responded to those," he said. "I can't speak to every offense."

Company owners downplayed security risks in documents submitted to the Texas Commission on Environmental Quality in 2006, saying thefts had dropped to zero over the preceding 20 months as meth makers now had found a substitute for anhydrous ammonia available at garden nurseries or major retailers.

VERY STRONG ODOR

Yet burglars and trespassers continued to target the facility. Following a series of break-ins in late 2008 and early 2009, including one where a trespasser visited pornographic websites on a secretary's computer, police told plant manager Ted Uptmore - who has worked at the company for decades -- to install a surveillance system. Later documents show the company complied. Uptmore did not respond to phone calls seeking comment for this story.

The last record of tampering was in October 2012, when a 911 caller reported an odor "so strong it can burn your eyes." The firm dispatched Cody Dragoo, an employee often sent after hours to shut leaking valves and look into break-ins. That night, he shut off the valve but reported it had been tampered with.

Two weeks ago, Dragoo, 50, was among those killed in the blast while responding to the fire.

(Editing By Janet Roberts, Martin Howell)

View the original article here

Gambling nun pleads guilty to theft from New York churches

By Jonathan Allen

(Reuters) - A Roman Catholic nun with an admitted gambling addiction faces up to six months in prison for stealing about $128,000 from two churches where she worked in western New York, prosecutors and her attorney said on Tuesday.

Sister Mary Anne Rapp, 68, pleaded guilty on Monday to grand larceny in Orleans County, just west of Rochester, New York. In addition to time in prison, she will make partial restitution of the stolen money, prosecutors said. Sentencing is scheduled for July 1.

Rapp admitted to stealing money from two churches to fund a gambling addiction from 2006 to 2011, according to the county's district attorney.

"She's extremely remorseful, and she's done what she can now to address the underlying problem," her attorney James Harrington said.

He said she underwent treatment for gambling addiction after being confronted about the missing money following an audit requested by a new pastor for the two churches in 2011.

The two churches - St. Mark's in Kendall and St. Mary's in Holley - lie about 8 miles apart in upstate New York, near the shore of Lake Ontario.

Rapp used some of the money to gamble at a casino in Niagara Falls, New York, which is about 60 miles to the west, he said.

"No one's above the law," Joseph Cardone, the Orleans County District Attorney said. "You certainly can't prey on parishioners of a church who give money in support of their cause."

(Reporting by Jonathan Allen in New York; Editing by Ellen Wulfhorst and Lisa Shumaker)

View the original article here