The indictment alleges that the cashers were allowed to keep 30 percent to 50 percent of the stolen funds, but transmitted the rest of the funds back to Tsurikov, Pleshchuk and other co-defendants. After discovering the unauthorised activity, RBS WorldPay, a division of the Royal Bank of Scotland, immediately reported the breach.
Several overseas law-enforcement agencies cooperated in the investigation. Estonian Central Criminal Police apprehended Tsurikov, Ronald Tsoi, Evelin Tsoi and Jevgenov in Estonia earlier this year. Each is facing related charges in Estonia. Tsurikov is also in custody in Estonia and is pending extradition to the U.S.
Cooperation between the Hong Kong Police Force and the U.S. Federal Bureau of Investigation also led to a parallel investigation in Hong Kong, resulting in the identification and arrest of two individuals who were responsible for withdrawing RBS WorldPay funds from ATMs there. The Netherlands Police Agency National Crime Squad High Tech Crime Unit and the Netherlands National Public Prosecutor's Office also provided significant assistance, the DOJ said.
Tsurikov, Pleshchuk, Covelin and Hacker 3 each face a maximum sentence of up to 20 years in prison for conspiracy to commit wire fraud and each wire fraud count; up to five years in prison for conspiracy to commit computer fraud; up to five or 10 years in prison for each count of computer fraud; a two-year mandatory minimum sentence for aggravated identity theft; and fines up to $3.5 million dollars.
The charges against Grudijev, the Tsois and Jevgenov carry a maximum of up to 15 years in prison for each count and a fine of up to $250,000. The indictment also seeks criminal forfeiture of $9.4 million from the defendants.
"The charges brought against this highly sophisticated international hacking ring were possible only because of unprecedented international cooperation with our law enforcement partners, particularly between the United States and Estonia," Lanny Breuer, assistant attorney general in the DOJ's Criminal Division, said in a statement.
Sally Quillian Yates, the acting U.S. attorney in the Northern District of Georgia, said the assistance of RBS WorldPlay and other law enforcement agencies helped solve the case.
"Last November, in just one day, an American credit card processor was hacked in perhaps the most sophisticated and organized computer fraud attack ever conducted," she said in a statement. "Today, almost exactly one year later, the leaders of this attack have been charged. This investigation has broken the back of one of the most sophisticated computer hacking rings in the world."