eBay-owned website defrauded of US$1m in cyber-heist

Six alleged cyber fraudsters have been charged in New York over their their roles in a global scheme that saw eBay-owned auction site StubHub defrauded out of at least US$1 million.

The six men have been indicted in connection with an international scheme that involved hacking into more than 1600 StubHub accounts and using the pre-existing payment card information tied to each account to purchase thousands of tickets to popular events, which were later resold.

As a result of the scheme, StubHub was defrauded out of more than US$1 million, Cyrus Vance, district attorney (DA) for Manhattan, announced today.

He said defendants in the United States, United Kingdom, Russia and Canada have been charged in New York State Supreme Court.

Vadim Polyakov and Nikolay Mateychuk, both from Russia, used payment card data and other information from StubHub accounts to purchase more than 3500 e-tickets to popular events. 

Polyakov and Mateychuk then sent the tickets to Daniel Petryszyn, Laurence Brinkmeyer and Bryan Caputo in New York and New Jersey, who resold the tickets just hours before each respective event and divided the proceeds into PayPal accounts controlled by Polyakov, as well as other bank accounts in the UK and Germany.

Sergei Kirin, from Russia, controlled one of those bank accounts, and laundered the money for a pro-rata fee, according to the DA.

StubHub learned and reported in March 2013 that more than a thousand accounts had been compromised and the associated payment card data was used to purchase tickets.

Despite an attempt to implement security measures, the gang was able to “circumvent security protocols within the accounts by using new credit card information stolen from additional victims,” Vance's office said.

Analysts in the DA's office traced the exchanges to IP addresses, PayPal accounts and other financial accounts used by the indicted individuals following an investigation of receipts and transaction records of the compromised accounts.

Polyakov was arrested in Spain on July 3 by Spanish law enforcement working with the United States Secret Service. Warrants were issued this week to search the residences of Petryszyn, Brinkmeyer and Caputo. Further arrests were made in England and Toronto under suspicion of money laundering tied to the case.

“It is important to note, there have been no intrusions into StubHub technical or financial systems,” StubHub said in a statement.

“Legitimate customer accounts were accessed by cyber criminals who had obtained the customers' valid login and password either through data breaches of other businesses, or through the use of keyloggers and/or other malware on the customers' PC.”