NEW YORK - Thailand was among 27 countries targetted by cyber criminals who stole at least $45 million by hacking into a database of prepaid debit cards and making withdrawals from ATMs.
The massive heist unfolded "in a matter of hours," said the US prosecutor's office for Brooklyn, New York.
Prosecutors unveiled charges against eight people accused of forming the New York cell of the plot. In their case, they allegedly lifted $2.8 million in cash and now face charges of conspiracy to commit access device fraud and money laundering.
Loretta Lynch, United States Attorney for the Eastern District of New York, speaks at a news conference in New York on Thursday, US time. (Reuters photo)
In addition to Thailand, the cyber thieves stole money from ATMs in Belgium, Bulgaria, Canada, Colombia, Dominican Republic, Egypt, Estonia, France, Germany, Great Britain, Indonesia, Italy, Japan, Latvia, Malaysia, Mexico, Netherlands, Pakistan, Romania, Russia, South Africa, Spain, Sri Lanka, Ukraine, United Arab Emirates and the United States.
Seven of the eight have been arrested, the US attorney's office said. The eighth, Alberto Yusi Lajud-Pena, who was the leader and was nicknamed "Prime" and "Albertico," is reported to have been murdered two weeks ago, the office said.
"The defendants and their co-conspirators participated in a massive 21st century bank heist that reached across the Internet and stretched around the globe," US Attorney Loretta Lynch said in a statement.
"In the place of guns and masks, this cybercrime organization used laptops and the Internet."
They thanked authorities from Thailand and other countries for helping in the investigation and arrests. The other countries were Belgium, Britain, Canada, the Dominican Republic, Estonia, France, Germany, Italy, Japan, Latvia, Malaysia, Mexico, Romania, Spain, and the United Arab Emirates.
The type of heist is known to criminals as an "unlimited operation" and two were allegedly carried out: first on December 22 last year and again on February 19-20 this year.
In the initial stage, taking several months, sophisticated hackers allegedly infiltrated credit card processors' computer networks, looking into databases of prepaid debit cards, a tool used often by employers and aid organisations.
Breaking into the system, the hackers eliminated withdrawal limits imposed by banks.
Next, the hackers cybergang distributed the debit card numbers to its street associates called "cashers," who loaded other magnetic stripe cards, like gift cards, with the stolen data.
Finally, the cashers were given stolen PIN numbers and sent to harvest the loot, going from ATM to ATM and withdrawing as much as cash as they could for the organization.
In the first alleged raid, hackers targeted RAKABANK in the United Arab Emirates. After manipulating the withdrawal limits, casher gangs worldwide hit the ATMs, conducting some 4,500 transactions worth $5 million across about 20 countries.
In the second attack, US prosecutors say, the group broke into the Bank of Muscat based in Oman. Then in the space of 10 hours, casher cells in 24 countries conducted some 36,000 transactions, withdrawing $40 million from ATMs.
The New York cell, the US attorney's office says, took $400,000 in the first raid and $2.4 million on the second, when it made some 3,000 ATM withdrawals.
The prosecutor's office highlighted the "surgical precision" of the alleged plot and "the speed and coordination with which the organization executes its operations on the ground. These attacks rely upon both highly sophisticated hackers and organized criminal cells whose role is to withdraw the cash as quickly as possible."
According to the indictment of the New York defendants, they quickly moved to launder their cash, opening a Miami bank account and pouring money into cars, including a Porsche and a Mercedes, and two Rolex watches. There was no detail given on the apparent murder of their leader just over two months after the second alleged heist.
Defendants Rafael Rodriguez,left, and Emir Yasser Yeje posing shortly after the theft of $45 million worldwide in a matter of hours via fabricated ATM cards. (Photo supplied by US Department of Justice)