Six individuals have been indicted in connection with an international scheme that involved hacking into more than 1,600 StubHub accounts and using the preexisting payment card information tied to each account to purchase thousands of tickets to popular events, which were later resold.
As a result of the scheme, StubHub was defrauded out of $1 million, Cyrus Vance, district attorney (DA) for Manhattan, announced on Wednesday, explaining defendants in the United States, United Kingdom, Russia and Canada have been charged in New York State Supreme Court.
Vadim Polyakov and Nikolay Mateychuk, both from Russia, used payment card data and other information from StubHub accounts to purchase more than 3,500 e-tickets to popular events, according to a Wednesday release. These include Elton John, Justin Timberlake and Jay-Z concerts, as well as Giants, Jets, Knicks and Nets games, and Broadway shows, such as Book of Mormon.
Polyakov and Mateychuk then sent the tickets to Daniel Petryszyn, Laurence Brinkmeyer and Bryan Caputo in New York and New Jersey, who resold the tickets just hours before each respective event and divided the proceeds into PayPal accounts controlled by Polyakov, as well as other bank accounts in the UK and Germany.
Sergei Kirin, from Russia, controlled one of those bank accounts, and laundered the money for a percentage as a fee, according to the release, which adds that thousands of dollars were also wired to launderers in London and Toronto.
StubHub learned and reported in March 2013 that more than a thousand accounts had been compromised and the associated payment card data was used to purchase tickets. Despite an attempt to implement security measures, the gang was able to “circumvent security protocols within the accounts by using new credit card information stolen from additional victims,” according to the release.
Analysts in the DA’s office traced the exchanges to IP addresses, PayPal accounts and other financial accounts used by the indicted individuals following an investigation of receipts and transaction records of the compromised accounts.
Polyakov was arrested in Spain on July 3 by Spanish law enforcement working with the United States Secret Service. Warrants were issued on Wednesday to search the residences of Petryszyn, Brinkmeyer and Caputo. Further arrests were made in England and Toronto under suspicion of money laundering tied to the case.
“It is important to note, there have been no intrusions into StubHub technical or financial systems,” according to a StubHub statement emailed to SCMagazine.com on Wednesday. “Legitimate customer accounts were accessed by cyber criminals who had obtained the customers’ valid login and password either through data breaches of other businesses, or through the use of keyloggers and/or other malware on the customers’ PC.”
Polyakov is charged with money laundering in the first degree, grand larceny in the first degree, criminal possession of stolen property in the second degree, 46 counts of criminal possession of stolen property in the third degree, 34 counts of criminal possession of stolen property in the fourth degree, and 27 counts of identity theft in the second degree.
Mateychuk is charged with money laundering in the fourth degree, and three counts of unlawful possession of personal identification information in the third degree.
Petryszyn, from New York, is charged with money laundering in the first degree, criminal possession of stolen property in the second degree, 46 counts of criminal possession of stolen property in the third degree, and seven counts of criminal possession of stolen property in the fourth degree.
Brinkmeyer, from New Jersey, is charged with money laundering in the first degree, 40 counts of criminal possession of stolen property in the third degree, and four counts of criminal possession of stolen property in the fourth degree.
Caputo, from New Jersey, is charged with five counts of criminal possession of stolen property in the third degree, and money laundering in the fourth degree. Kirin is charged with money laundering in the second degree.