The Great ATM Heist: How Thieves Stole $45million In A Few Hours.

This might look like another George Clooney film, but it ain't. There are just so many things that go on that we just don't know about.


Federal prosecutors in New York announced on Thursday that police had arrested seven suspects in one of the biggest bank heists in history — and none of the hundreds of people involved in 27 countries used a gun or bomb threat, or even set foot inside a bank lobby. U.S. Attorney Loretta Lynch compared the sophisticated, "surgical" heist — which netted $45 million in two separate operations — to the casino-theft movie Ocean's Eleven. (Watch an NBC News report on the heist below.)

The network of hackers and street criminals "participated in a massive 21st-century bank heist that reached across the internet and stretched around the globe," Lynch said at a news conference. The plot sounds ready-made for Hollywood. To give a sense of the scope of this operation, here are some key numbers:

$45 million
Amount stolen in a matter of hours in two ATM-withdrawal sprees, on Dec. 22, 2012, and Feb. 19-20, 2013

40,500
Total ATM withdrawals

27
Countries where ATMs were raided in the two operations

17
Prepaid credit card accounts used in the heist, five in December and 12 in February

$2.8 million
Amount stolen from Manhattan ATMs, including $2.4 million on Feb. 19-20

2,904
ATM withdrawals over the 10-hour spree in Manhattan on Feb. 19-20

How did several hundred people manage to pull off a huge bank heist without anyone noticing? The Justice Department says the thieves used what the cyber-criminal underground calls "Unlimited Operations." This is how it works, according to federal prosecutors:

The "Unlimited Operation" begins when the cyber-crime organization hacks into the computer systems of a credit card processor, compromises prepaid debit card accounts, and essentially eliminates the withdrawal limits and account balances of those accounts. The elimination of withdrawal limits enables the participants to withdraw literally unlimited amounts of cash until the operation is shut down.... These attacks rely upon both highly sophisticated hackers and organized criminal cells whose role is to withdraw the cash as quickly as possible....

First, over the course of months, the hackers plan and execute sophisticated cyber intrusions to gain unauthorized access to the computer networks of credit card processors that are responsible for processing prepaid debit card transactions. They target databases of prepaid debit cards, which are typically loaded with finite funds; such cards are used by many employers in lieu of paychecks and by charitable organizations to distribute disaster assistance.... Next, the cybercrime organization cashes in, by distributing the hacked prepaid debit card numbers to trusted associates around the world.... These associates operate cells or teams of "cashers," who encode magnetic stripe cards, such as gift cards, with the compromised card data. When the cybercrime organization distributes the personal identification numbers (PINs) for the hacked accounts, the casher cells spring into action, immediately withdrawing cash from ATMs across the globe. [DOJ]

The hacker-masterminds watched the ATM withdrawals on their computers, so they wouldn't get cheated out of their share — the eight-member New York cell kept 20 percent of their haul, Lynch said, and sent the rest to the heist organizers. Then the "cashers" laundered the money, in part by buying Rolex watches and luxury cars.

The feds didn't provide much information about the international investigation into the global heist, or say how many people have been arrested in other countries. And they didn't drop any clues as to who organized the operation, other than saying that an email links the New York cell to a money-laundering gang in St. Petersburg, Russia. But the New York group appears to have been caught at least partly through old fashioned police work, mixed with a dash of modern hubris: The thieves were photographed by multiple ATMs, their backpacks getting visibly heavier at each stop, and some posted photos of themselves with wads of cash.

Here's where things get really dramatic: The New York cell was made up of eight Dominican-Americans living in Yonkers. The first member was arrested March 27, trying to flee to the Dominican Republic, and the last two were picked up on Wednesday. The alleged ringleader, Alberto Yusi Lajud-Peña, wasn't arrested because he's dead. The New York Times explains:

Lajud-Peña fled the United States just as the authorities were starting to make arrests of members of his crew, the law enforcement official said. On April 27, according to news reports from the Dominican Republic, two hooded gunmen stormed a house where he was playing dominoes and began shooting. A manila envelope containing about $100,000 in cash remained untouched. [New York Times]

Yikes, says Tom Levenson at Balloon Juice. "I have no doubt that there are folks involved in this that you really, really don't want to irritate." But while $45 million is a huge haul, this is still the "least surprising story of the year," he argues:

Part of me says that this is something to note because so much of the financial life of individuals and the economy writ large depends on the secure functioning of — and user trust in — global banking systems at every level from the corner ATM to the massive inter-bank clearing mechanisms. The cyber-security people I talk to have to hold their hands over the mouths to stop themselves from blurting "WAKE UP SHEEPLE!!!!!" — as that trust rests on a rickety tangle of hardware and software. So while there's a kind of Great Train Robbery thrill to the idea of capers like these, this could get ugly indeed.

In other words, even though no individual's bank account was compromised in this attack, everyone who doesn't keep their savings under the mattress is vulnerable. In this case, the hackers were able to exploit the weak links in the financial system — U.S. and Indian credit card processors, considered less secure than banks, and prepaid cards issued by banks in the Persian Gulf, where customers are generally allowed to put much larger amounts on prepaid cards and the banks don't monitor the cards as closely. "Hackers only need to find one vulnerability to cause millions of dollars of damage," former cyber-crimes prosecutor Mark Rasch tells Reuters.

Of course, the question everyone wants answered, says Balloon Juice's Levenson, is "what role George Clooney will play?"

Source

Interesting. More interesting: no Nigerian implicated.

Nigerians are yet to possess this kind of intellectual cyber power nah.

Nigerians are already hacking into banks' system and wiring d cash, makin it look like a customer induced internet transfer.

oseiwe: Nigerians are already hacking into banks' system and wiring d cash, makin it look like a customer induced internet transfer.

This one is small fry compared to the ATM Heist.

Yawning

.

The real wise guys

Bad Boys!

Nutin to write

Puskin

I would like to apologize to anyone I have NOT offended. Please be patient, I will get to YOU,
shortly.

Dazz all

Damn,Op ur post is 2 long,cant evn read it,talkless of comprehending it.

Whoa!

Na wa for waec maennn!!!!!!!!

These guys don't look slick! They don't look like they have the savvy or systems intelligence to pull this off, yet these unassuming wetbacks are the main perps?!
Man, Respect!

damn....technology is good....but dangerous in d hands of black-hats....one sweet ting is dat they can run....but neva hide....cos nemesis will catch up wit 'em....hahahaha surf safe

$62,000 was allegedly stolen from Prince Buruji Kashamu's briefcase by a popular airline operator.
Now how do we explain that?

wow

For what shall it profit a man if he gains d whole world and loss his soul. I just hope they turn from their evil thiefry way of getting income.

Naija no dey carry last.

Just wait and see.

click like only if you believe!

no copy and paste pls

While they take every opportunity to paint us black, the fact still remains that we are learners compared to the west in terms of fraud.

Whatever we do, we learnt from them, and before we catch up, they have found a more sophisticated one.

yuzedo: Whoa!

Na wa for waec maennn!!!!!!!!

These guys don't look slick! They don't look like they have the savvy or systems intelligence to pull this off, yet these unassuming wetbacks are the main perps?!
Man, Respect!

They are Italian and Latino and not mexican bean eyed knifers

Naija boys still dey do yahoo-yahoo

Chitexs250: Puskin

I would like to apologize to anyone I have NOT offended. Please be patient, I will get to YOU,
shortly.

Dazz all

da-gentility:
Damn,Op ur post is 2 long,cant evn read it,talkless of comprehending it.

Romance section has some nice, simple topics today. Go knock yourself out.

Very inspiring.

Nollywood pls take note

As shocking as it is....the level of patience and organization shown by the hackers at the top of the chain is exquisite. Nonetheless,a crime remains a crime and Network Security a volatile field. Hope they're apprehended and that level of intelligence put to good use.

dokunbam: Nollywood pls take note

chai, if nollywood ever act this stuff eeeh

that wat i call stealing

This is the best way to steal than bloodily killg ad stealg!

my ban go expire tomolo . Where Ikenna 351 dey? *dancing azonto*