5 ms·

> As for the hackers, they didn’t make much profit -- Oprea, the ring leader, made only $40,000. He paid a steep price for the estimated $12.5 million in losses

> As for the hackers, they didn’t make much profit -- Oprea, the ring leader, made only $40,000. He paid a steep price for the estimated $12.5 million in losses inflicted on financial institutions The article doesn't explain the discrepancy between the tiny earnings of the hackers and the enormous loss of the banks. Which one of these is it?: 1) The hackers lied and have millions stashed away some place? 2) The middlemen who buy the card data from the hackers and get mules to make fraudulent charges and withdrawals are the ones raking it in? 3) The banks are puffing up their losses in order to get tax deductions or make insurance claims, or maybe just to get the Secret Service interested enough in the case to do an investigation? The banks can exaggerate their loss in all kinds of ways: including in the loss payments that they were able to later reverse, or including losses that were eaten by the merchants and not the bank, or including the salary of every member of their security and fraud department, etc.

ballard 13y ago
Hmmm. Stashed in BTC or LTC? Maybe one em gambled it all away.
dublinben 13y ago
Your second guess can account for a lot of the discrepancy. Stolen credit card records are sold for $1 or less by the original source. The real profit (and risk) is in the process of extracting value from the cards.
- nnq 13y ago
  How do people manage to extract value from stolen credit cards without getting caught? To me this is the most interesting part of the whole "hacking chain" and almost nobody can/wants to explain it... And it's also obvious that if law enforcement would concentrate on making this harder to do, the value of stolen cc numbers would very fast o low enough to make the hacker loose any incentive for doing this kind of thing.
  - smm2000 13y ago
    You clone credit card (can be done with $10 worth of equipment), go to the store and buy something expensive. Sell it on craigslist or (if you are brazen) return for refund. It's high risk process involving going to the store so most of the profits go to the mules. Credit card numbers are cheap - just a few dollars per card. There is black market for that stuff - you can google and find a bunch of articles about it.
  - Noxchi 13y ago
    Get behind 7 proxies and order stuff from online to a vacant house.
leaveyou 13y ago
Judging by the Subway example which spent "5 millions $" to upgrade its "cyber security systems" (what?), almost any direct or indirect loss or cost incurred during or after the hacker attack can be imputed to the perpetrator. It's like if I have a weak entrance door and some thief enters and steals something then I can say that he caused me loses of millions because I had to upgrade all the doors in the house and hire detectives and a security company to guard me better from now on.
- happyscrappy 13y ago
  Portray them as victims if it helps your world view, but I will not lose any sleep over their fines that will never be repaid.
  - x0x0 13y ago
    Trying to lay the bill for making your systems secure at the feet of the individual hackers who got into your systems seems wrong. I'm not arguing that what these guys did was legal or good or that they shouldn't be prosecuted, but something about that grates; it's an expense the company (should have) paid beforehand and these guys wouldn't have been able to do what they did. If a system is on the internet, securing it is a cost that has to be born by the retailer.
thematt 13y ago
They probably sold the cards in bulk to organized crime rings or the like, netting $40K. Those thugs then skim what they can from the cards that aren't locked and that's probably the majority of that $12.5 million.
bpodgursky 13y ago
Theft can destroy a lot more value than the goods themselves: - stolen goods are hard to sell, and like others have mentioned credit cards are re-sold to others who make most of the profit - even if there is a suspicion that a card has been stolen, it is often re-issued, causing a lot of operational cost even if it was not actually among those stolen A lot of other options too like others have mentioned.
Bahamut 13y ago
Credit card companies will usually refund fraud related charges, so while their consumers don't get affected, the banks do take the hit here.
- deleted 13y ago
  [deleted]

ballard 13y ago

Hmmm. Stashed in BTC or LTC? Maybe one em gambled it all away.

dublinben 13y ago

Your second guess can account for a lot of the discrepancy. Stolen credit card records are sold for $1 or less by the original source. The real profit (and risk) is in the process of extracting value from the cards.

nnq 13y ago
How do people manage to extract value from stolen credit cards without getting caught? To me this is the most interesting part of the whole "hacking chain" and almost nobody can/wants to explain it... And it's also obvious that if law enforcement would concentrate on making this harder to do, the value of stolen cc numbers would very fast o low enough to make the hacker loose any incentive for doing this kind of thing.
- smm2000 13y ago
  You clone credit card (can be done with $10 worth of equipment), go to the store and buy something expensive. Sell it on craigslist or (if you are brazen) return for refund. It's high risk process involving going to the store so most of the profits go to the mules. Credit card numbers are cheap - just a few dollars per card. There is black market for that stuff - you can google and find a bunch of articles about it.
- Noxchi 13y ago
  Get behind 7 proxies and order stuff from online to a vacant house.

leaveyou 13y ago

Judging by the Subway example which spent "5 millions $" to upgrade its "cyber security systems" (what?), almost any direct or indirect loss or cost incurred during or after the hacker attack can be imputed to the perpetrator. It's like if I have a weak entrance door and some thief enters and steals something then I can say that he caused me loses of millions because I had to upgrade all the doors in the house and hire detectives and a security company to guard me better from now on.

happyscrappy 13y ago
Portray them as victims if it helps your world view, but I will not lose any sleep over their fines that will never be repaid.
- x0x0 13y ago
  Trying to lay the bill for making your systems secure at the feet of the individual hackers who got into your systems seems wrong. I'm not arguing that what these guys did was legal or good or that they shouldn't be prosecuted, but something about that grates; it's an expense the company (should have) paid beforehand and these guys wouldn't have been able to do what they did. If a system is on the internet, securing it is a cost that has to be born by the retailer.

thematt 13y ago

They probably sold the cards in bulk to organized crime rings or the like, netting $40K. Those thugs then skim what they can from the cards that aren't locked and that's probably the majority of that $12.5 million.

bpodgursky 13y ago

Theft can destroy a lot more value than the goods themselves: - stolen goods are hard to sell, and like others have mentioned credit cards are re-sold to others who make most of the profit - even if there is a suspicion that a card has been stolen, it is often re-issued, causing a lot of operational cost even if it was not actually among those stolen A lot of other options too like others have mentioned.

Bahamut 13y ago

Credit card companies will usually refund fraud related charges, so while their consumers don't get affected, the banks do take the hit here.

deleted 13y ago
[deleted]