Bulgarian Citizen Extradited to U.S. to Face Indictment Charging Sale of Stolen Payment Card Data, Accounting Firm Hacks

NEWARK, NJ—Vanyo Minkov, 31, a citizen of the Republic of Bulgaria, is expected to appear in Newark federal court today following his extradition to face charges that he orchestrated two international conspiracies—to sell stolen payment card data and to file bogus tax returns using hacked information—that resulted in approximately $56 million in losses, New Jersey U.S. Attorney Paul J. Fishman announced.
As charged in the federal indictment, Minkov acquired stolen credit and debit card information and sold it online. He is also charged with hacking into the networks of multiple accounting firms to steal 2011 year tax filings from the firms’ clients and then using that information to file returns in their names the following year.
The U.S. Secret Service (USSS) and the IRS led an investigation coordinated with the Sofia, Bulgaria Office of the USSS; the FBI; Bulgarian law enforcement to identify and arrest Minkov in Bulgaria. He has been in the custody of Bulgarian authorities since his arrest in late May 2013 and was extradited to the United States on September 27, 2013.
According to documents filed in this case:
Between July 2011 and April 2013, Minkov participated in a scheme in which he sold stolen credit and debit card numbers and related personal identifying information online for profit. Minkov had multiple sources of the stolen data, including through the use of ATM skimming operations using specialized equipment to steal debit card information and PINs. Minkov obtained and sold stolen payment card data for more than 100,000 accounts during the course of the conspiracy. The losses caused by the scheme are currently estimated at approximately $50 million.
Some of the purchasers of the data paid using international money transfers sent from New Jersey.
Minkov also orchestrated a tax refund scheme in which he and his co-conspirators hacked into the networks of multiple accounting firms and stole the firm’s clients’ tax filings for tax year 2011. Minkov and his conspirators then used the stolen information to file false and fraudulent tax returns for the 2012 tax year in the names of the accounting firms’ clients. Because Minkov used the previous returns, the fraudulent filings are more difficult to detect. To date, the IRS has identified approximately more than $6 million in fraudulent claims made to the IRS in connection with the scheme.
The maximum potential penalties for each count are as follows:

Count	Violation	Maximum Potential Penalty
One	Conspiracy to commit wire fraud	30 years; $1 million fine or twice the gain or loss from the offense
Two	Conspiracy to defraud the government with respect to claims	10 years; $250,000 fine or twice the gain or loss from the offense
Three	Conspiracy to commit fraud and related activity in connection with identification documents, authentication features, and information	15 years; $250,000 fine or twice the gain or loss from the offense
Four	Conspiracy to commit fraud and related activity in connection with computers	five years; $250,000 fine or twice the gain or loss from the offense

U.S. Attorney Fishman credited special agents of the USSS, Newark Field Office, under the direction of Special Agent in Charge James Mottola, and the IRS, under the direction of Special Agent in Charge Shantelle P. Kitchen, for the ongoing investigation leading to the charges. U.S. Attorney Fishman also thanked the FBI, the Justice Department’s Office of International Affairs in Washington, and the Supreme Cassation Prosecutor’s Office of the Republic of Bulgaria and its law enforcement partners for their extraordinary support.
The government is represented by Assistant U.S. Attorney Andrew S. Pak of the Computer Hacking and Intellectual Property Section of the U.S. Attorney’s Office Economic Crimes Unit in Newark.
The charges and allegations contained in the indictment are merely accusations, and the defendant is considered innocent unless and until proven guilty.

Nasser Qayed Sentenced in Knoxville-Detroit Scheme Involving Contraband Cigarettes

KNOXVILLE—On Friday, September 13, 2013, Nasser Qayed, 41, of Detroit, Michigan, was sentenced by the Honorable Leon Jordan, Senior U.S. District Court Judge, to serve 21 months in federal prison for his convictions of receiving and concealing stolen goods traveling in interstate commerce. Additionally, the court ordered him to pay $121,000 in restitution.
Qayed was a former convenience store operator in Detroit who participated in a Knoxville-to-Detroit contraband cigarette smuggling ring. He pleaded guilty in May 2012 to two counts of receiving and concealing stolen goods in interstate commerce.
The conviction of Qayed and others involved in this contraband cigarette smuggling ring was the result of a long-term undercover investigation by the FBI Joint Terrorism Task Force. Assistant U.S. Attorney Jeff Theodore represented the United States.

Two Sentenced for Transportation and Attempted Sale of Stolen Matisse Painting

Wifredo A. Ferrer, United States Attorney for the Southern District of Florida, and Michael B. Steinbach, Acting Special Agent in Charge, Federal Bureau of Investigation (FBI), Miami Field Office, announced today’s sentencing of Pedro Antonio Marcuello Guzman, 46, of Miami, Florida, and Maria Martha Elisa Ornelas Lazo, 50, of Mexico City, Mexico, on charges relating to the July 17, 2012 interstate transportation and attempted sale of the stolen Henri Matisse painting “Odalisque in Red Pants” in Miami Beach, Florida.
At today’s hearing, U.S. District Judge Donald M. Middlebrooks sentenced Pedro Marcuello to 33 months in prison, to be followed by three years of supervised release. Maria Ornelas was sentenced to 21 months in prison, to be followed by three years’ supervised release. The defendants pled guilty on October 30, 2012, to charges relating to the transportation, possession, and attempted sale of the stolen Henri Matisse painting.
According to court documents, between December 2011 and July 13, 2012, Marcuello, in a series of meetings with undercover agents of the FBI, negotiated the sale of an original Henri Matisse painting entitled “Odalisque in Red Pants,” which had been stolen from the Caracas Museum of Contemporary Art in Caracas, Venezuela, around December 2002. During these meetings, Marcuello agreed to sell the stolen painting to the undercover agents for approximately $740,000 and also agreed to have the painting transported by courier to the United States from Mexico, where the painting was stored. The courier was identified by Marcuello as co-defendant Ornelas. Thereafter, on July 16, 2012, Ornelas transported the stolen Matisse painting to Miami from Mexico City. According to court documents, the following day, both Marcuello and Ornelas produced the Matisse painting titled “Odalisque in Red Pants” to undercover agents as part of the purported sales transaction. At the time of the purported sales transaction, both Marcuello and Ornelas knew the Matisse painting had been stolen.
Mr. Ferrer commended the investigative efforts of the FBI. Mr. Ferrer would also like to thank the FBI Legal Attachés in Caracas and Paris, the Department of Justice Office of International Affairs, and the Department of Justice Attaché in Paris. The case was prosecuted by Assistant U.S. Attorney Elisa Castrolugo.
A copy of this press release may be found on the website of the United States Attorney’s Office for the Southern District of Florida at http://www.usdoj.gov/usao/fls.

Two Essex County Men Charged in Connection with Stealing Three Cars in One Day

NEWARK—Two Essex County, New Jersey men appeared in Newark federal court today in connection with charges arising out of three carjackings that occurred on the same day in March 2012 in Essex and Hudson counties, U.S. Attorney Paul J. Fishman announced.
Louis Holmes, 24, of Newark, is charged in a five-count complaint with one count of conspiracy to commit carjacking; three counts of theft of a motor vehicle by force, violence, and intimidation; and one count of use of a firearm in furtherance of a crime of violence. Rosendo Perez, 24, of Irvington, is charged in the same complaint with one count of conspiracy to commit carjacking; one count of theft of a motor vehicle by force, violence, and intimidation; and one count of use of a firearm in furtherance of a crime of violence.
Both were already in state custody when they were charged by complaint on December 20, 2012. They both made their initial appearances before U.S. Magistrate Judge Cathy L. Waldor in Newark federal court today.
According to the criminal complaint:
On the afternoon of March 27, 2012, Holmes and Perez approached two individuals who were sitting in a parked 2009 Acura TL in the area of South 17th Street in Newark. Holmes pointed a firearm at the victims, and both Holmes and Perez ordered the victims out of the car. Holmes and Perez then fled the area in the carjacked vehicle.
That night, Holmes accosted an individual who was approaching a parked 2010 Nissan Maxima, in which another individual was sitting. The car was parked in a McDonald’s parking lot on Communipaw Avenue in Jersey City. Holmes pointed a firearm at the victims, demanded the car keys, and ordered one victim out of the car. Holmes then fled the area in the carjacked vehicle.
One hour later, Holmes approached an individual who was standing near a 2008 Nissan Altima in the area of Mt. Pleasant Avenue in Newark. Holmes pointed a firearm at the victim and demanded the car keys. Holmes then fled the area in the carjacked vehicle.
The next day, police observed the 2009 Acura TL, which was carjacked during the afternoon of the prior day. A motor vehicle pursuit ensued through the cities of Newark and East Orange until Perez, the driver of the carjacked vehicle, lost control of the car and crashed. Holmes was a passenger of the carjacked vehicle. Both Holmes and Perez exited the carjacked vehicle and attempted to flee the area but were apprehended shortly after the crash. Just before he was apprehended, Holmes allegedly threw a handgun loaded with six hollow-point rounds to the ground.
The charge of conspiracy to commit carjacking (count one) is punishable by a maximum potential penalty of five years in prison. The carjacking counts (count two, four, and five) each are punishable by a maximum potential penalty of 15 years in prison. The charge of use of a firearm in furtherance of a crime of violence (count three) is punishable by a maximum potential penalty of life in prison and a mandatory minimum sentence of seven years in prison, which must run consecutively to any other prison term. Each of the five counts also carries a maximum fine of $250,000.
U.S. Attorney Fishman credited special agents of the FBI, under the direction of Acting Special Agent in Charge David Velazquez in Newark; the Newark Police Department, under the direction of Police Director Samuel A. DeMaio and Chief Sheilah A. Coley; and the Essex County Prosecutor’s Office, under the direction of Acting Prosecutor Carolyn A. Murray; the Jersey City Police Department, under the direction of Acting Police Director Robert Kakoleski and Chief Thomas J. Comey; the Hudson County Prosecutor’s Office, under the direction of Acting Prosecutor Gaetano T. Gregory, as well as criminal investigators from the U.S. Attorney’s Office in Newark with the investigation leading to the charges.
The government is represented by Assistant U.S. Attorney Lisa M. Colone of the U.S. Attorney’s Office Criminal Division in Newark.
The charges and allegations contained in the complaint are merely accusations, and the defendants are considered innocent unless and until proven guilty.

New York Man Convicted of Hacking AT&T’s Servers

NEWARK—A federal jury today convicted the head of a self-described “security research” hacking group of breaching AT&T’s servers, stealing e-mail addresses and other personal information belonging to approximately 120,000 Apple iPad users, and disclosing that information to an Internet magazine, U.S. Attorney Paul J. Fishman announced.
Andrew Auernheimer, 27, of New York, was convicted of both counts of a superseding indictment: conspiracy to access AT&T’s servers without authorization and disclose that information to a reporter at Gawker magazine and possession and transfer of means of identification for more than 120,000 iPad users. Auernheimer was tried before U.S. District Judge Susan D. Wigenton in Newark federal court. His co-conspirator, Daniel Spitler, 27, of San Francisco, California, previously pleaded guilty to the same charges and is awaiting sentencing.
According to documents filed in this case and the evidence at trial:
The iPad is a touch-screen tablet computer, developed and marketed by Apple Computers Inc., that allows users to, among other things, access the Internet and send and receive electronic mail. Since its introduction in January 2010, AT&T has provided iPad users with Internet connectivity via AT&T’s 3G wireless network. During the registration process for subscribing to the network, a user is required to provide an e-mail address, billing address, and password.
Prior to mid-June 2010, AT&T automatically linked an iPad 3G user’s e-mail address to the Integrated Circuit Card Identifier (ICC-ID), a number unique to the user’s iPad, when he or she registered. Every time a user accessed the AT&T website, the ICC-ID was recognized and the e-mail address was automatically populated for faster, user-friendly access to the site. AT&T kept the ICC-IDs and associated e-mail addresses confidential.
At that time, when an iPad 3G communicated with AT&T’s website, its ICC-ID was automatically displayed in the Universal Resource Locator, or URL, of the AT&T website in plain text. Seeing this, and discovering that each ICC-ID was connected to an iPad 3G user e-mail address, hackers wrote a script termed the “iPad 3G Account Slurper” and deployed it against AT&T’s servers.
The Account Slurper attacked AT&T’s servers for several days in early June 2010 and was designed to harvest as many ICC-ID/e-mail address pairings as possible. It worked by mimicking the behavior of an iPad 3G so that AT&T’s servers would be deceived into granting the Account Slurper access. Once deployed, the Account Slurper used a process known as a “brute force” against the servers, randomly guessing at ranges of ICC-IDs. An incorrect guess was met with no additional information, while a correct guess was rewarded with an ICC-ID/e-mail pairing for a specific, identifiable iPad 3G user.
From June 5, 2010 through June 9, 2010, the Account Slurper stole for its hacker-authors approximately 120,000 ICC-ID/e-mail address pairings for iPad 3G customers.
Immediately following the theft, the hacker-authors of the Account Slurper provided the stolen e-mail addresses and ICC-IDs to the website Gawker, which published the stolen information in redacted form, along with an article concerning the breach. The article indicated that the breach “exposed the most exclusive e-mail list on the planet” and named a number of famous individuals whose e-mails had been compromised, including Diane Sawyer, Harvey Weinstein, New York Mayor Michael Bloomberg, and then-White House Chief of Staff Rahm Emanuel. The article also stated that iPad users could be vulnerable to spam marketing and malicious hacking. A group calling itself “Goatse Security” was identified as obtaining the subscriber data.
Goatse Security is a so-called “security research” group, composed of Internet hackers, to which both Spitler and Auernheimer belonged.
During the data breach, Spitler and Auernheimer communicated with one another using Internet Relay Chat, an Internet instant messaging program. Those chats not only demonstrated that Spitler and Auernheimer were responsible for the data breach, but also that they conducted the breach to simultaneously damage AT&T and promote themselves and Goatse Security. As the data breach continued, so too did the discussions between Spitler, Auernheimer, and other Goatse Security members about the best way to take advantage of the breach and associated theft. On June 10, 2010, immediately after going public with the breach, Spitler and Auernheimer discussed destroying evidence of their crime.
Each count on which Auernheimer was convicted is punishable by a maximum potential penalty of five years in prison and a fine of $250,000.
U.S. Attorney Fishman credited special agents of the FBI, under the direction of Special Agent in Charge Michael B. Ward in Newark, with the investigation leading to the charges. He also thanked special agents of the FBI, under the direction of Special Agent in Charge Valerie Parlave in Little Rock, Arkansas, and the U.S. Attorney’s Office for the Western District of Arkansas, under the direction of U.S. Attorney William Conner Eldridge.
The government is represented by Executive Assistant U.S. Attorney Michael Martinez and Assistant U.S. Attorney Zach Intrater of the Computer Hacking and Intellectual Property Section of the U.S. Attorney’s Office Economic Crimes Unit.