U.S. charges three in huge cyber fraud targeting JPMorgan, othersReprints
(Reuters) — U.S. prosecutors on Tuesday unveiled criminal charges accusing three men of running a sprawling array of hacking and fraud schemes, including a huge 2014 attack against JPMorgan Chase & Co., that generated hundreds of millions of dollars of illegal profit.
Gery Shalon, Joshua Samuel Aaron and Ziv Orenstein were charged in a 23-count indictment over alleged crimes targeting 12 companies, including nine financial services companies as well as media outlets including The Wall Street Journal.
Prosecutors said the enterprise dated to 2007 and included pumping up stock prices, online casinos, payment processing for criminals, an illegal bitcoin exchange, and at least 75 shell companies and accounts around the world. Another defendant, Anthony Murgio, was charged over the bitcoin exchange.
“By any measure, the data breaches at these firms were breathtaking in scope and in size,” U.S. Attorney Preet Bharara said at a press conference.
Tuesday's charges substantially expand a criminal case first announced in July. They are also the first tied to the JPMorgan attack, which compromised information in 83 million customer accounts in what prosecutors called the largest theft of customer data from a U.S. financial institution.
Authorities said Messrs. Shalon and Aaron executed that hacking, using a computer server in Egypt that they had rented under an alias that Mr. Shalon often used.
E*Trade Financial Corp., TD Ameritrade Holding Corp. and News Corp.'s Dow Jones unit, which publishes The Wall Street Journal, said they were also targeted by defendants in the case.
Fidelity Investments was also a target, a person familiar with the matter said, and Scotttrade Inc. was also a target, according to a law enforcement source.
Mr. Shalon, 31, and Mr. Orenstein, 40, are Israeli nationals who were arrested in July. Mr. Murgio, from Florida, was also arrested that month. Mr. Aaron, 31, is a U.S. citizen who has lived in Moscow and Tel Aviv.
JPMorgan on Tuesday confirmed that the latest charges relate to the 2014 attack, and said it continues to cooperate with law enforcement efforts to fight cybercrime.
E*Trade said it has contacted 31,000 customers who may have been affected. News Corp. said the indictment relates to a breach that targeted subscribers, and which was disclosed on Oct. 9.
Lawyers for the defendants were not immediately available for comment.
The new charges portray Mr. Shalon as the ringleader, having orchestrated hackings since 2012 against nine companies in which personal information for more than 100 million customers was stolen.
He and Mr. Orenstein were accused of having since 2007 run at least 12 illegal Internet casinos, generating millions of dollars of profit each month.
They allegedly also ran IDPay and Todur, through which they collected $18 million of fees to process hundreds of millions of dollars of transactions for criminals.
According to the indictment, the illegal proceeds included tens of millions of dollars from manipulating the prices of stocks sold to customers whose information had been stolen.
Mr. Shalon was also accused of concealing at least $100 million in Swiss and other accounts, and running Coin.mx with Mr. Murgio.
Mr. Aaron, meanwhile, was identified in an FBI “wanted” poster as the “front-man” in a scheme where, using the alias “Mike Shields,” he conspired to drive up stock prices and then dump shares at inflated prices, collecting tens of millions of dollars of profit.
The indictment against Messrs. Shalon, Orenstein and Aaron includes counts of computer hacking, securities and wire fraud, identity theft, illegal Internet gambling and conspiring to commit money laundering. Not all counts were brought against all defendants.
Mr. Murgio faces seven counts including wire fraud, money laundering and operating an unlicensed money transmitter.
The U.S. Securities and Exchange Commission previously filed civil charges against Messrs. Shalon, Aaron and Orenstein.