Russian Hackers Sentenced in Heartland Payment Systems Breach Case

It's been 10 years since the historic and widespread payment card data breaches at Heartland Payment Systems, NASDAQ, and other major US companies, and this week two members of the group of cybercriminals that pulled off those hacks were sentenced to federal prison.

Russian citizens Vladimir Drinkman, 37, of Syktyvkar and Moscow, Russia, and Dmitriy Smilianets, 34, of Moscow, both of whom had pleaded guilty in 2013, were part of a team working with the infamous Albert Gonzalez that stole data from Heartland, NASDAQ, 7-Eleven, Carrefour, JCP, Hannaford, Dow Jones, Wet Seal, Commidea, Dexia, JetBlue, Euronet, Visa Jordan, Global Payment, Diners Singapore, and Ingenicard.

Drinkman was sentenced to 12 years in prison for conspiracy to commit unauthorized access of protected computers as well as one count of conspiracy to commit wire fraud. Smilianets, who had pleaded guilty to conspiracy to commit wire fraud that affected a financial institution, will face 51 months and 21 days in prison. Each also faces three years of supervised release at the end of their prison terms. They were arrested in the Netherlands in June of 2012; Smilianets was extradited to the US in September of that year, and Drinkman, in 2015.

The cyberattacks resulted in the theft of some 160 million credit card numbers and over $300 million in losses, and it's the largest such cybercrime case ever prosecuted in the US. Two other men who were indicted remain at large: Roman Kotov, 36, of Moscow, and Mikhail Rytikov, 30, of Odessa, Ukraine.

Drinkman and Kalinin hacked into the targeted companies' networks and infiltrated their systems, and then with the help of Kotov, Drinkman exfiltrated the payment card and other sensitive data, including user credentials and personal information. Rytikov provided anonymous Web hosting services to the hackers to hide their activity. Smilianets then sold the stolen information and paid the attackers their cut.

The attackers used encrypted channels to communicate with one another, and in some cases met one another in person in case law enforcement was able to trace their electronic communications. They remained under the radar within the victim organization networks by evading security software and disabling electronic logging of their activities.

In 2009, Drinkman and Kalinin were charged as "Hacker 1" and "Hacker 2" in an indictment charging Gonzalez – who is serving a 20-year prison sentence - for breaches at Heartland, Hannaford's, 7-Eleven, TJX, and others. Gonzalez conducted most of his hacking during 2005 to 2008 while he served as a paid undercover informant for the US Secret Service. He called his cybercrime enterprise "Operation Get Rich Or Die Tryin.'" 

Acting US Attorney William E. Fitzpatrick said of Drinkman and Kalinin after their sentencing: "These defendants operated at the highest levels of illegal hacking and trafficking of stolen identities. They used their sophisticated computer skills to infiltrate computer networks, steal information and sell it for a profit. Perpetrators of some of the largest data breaches in history, these defendants posed a real threat to our economy, privacy and national security, and cannot be tolerated."

The pair did not receive the maximum sentencing penalties for their crimes, however. Marcus Christian, a partner in the Washington, DC office of law firm Mayer Brown, notes that Drinkman and Smilianets each entered plea deals, which explains their relatively light prison terms and the seemingly long time between their arrests and ultimate sentencing. "You rarely see someone [with Drinkman's high Sentencing Guidelines score] getting 12 years," Christian says. A person with no criminal record and Drinkman's score can receive a sentence of 360 months, he explains, so it may be that the two cooperated with authorities in the investigation.

The attackers mostly exploited SQL injection vulnerabilities in the targeted companies' computers, where they then planted backdoor malware that provided them a foothold in the network, in some cases for more than a year. They employed "sniffer" programs to root out and pilfer the data, storing the stolen information in systems scattered around the globe.

What this data breach case demonstrates, says Christian, is that "persistence matters" for law enforcement. "It also takes a lot of resources for some of the better and more elusive cybercriminals," says Christian, who handles cybercrime and white-collar crime investigation cases. "The case was initiated in 2009, and [some of the events] took place several years before that. It was quite an undertaking."

Related Content:

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.