Turkish hacker gets 8 years in $55M ATM milking scheme

The sentence, which also included a requirement that Ercan Findikoglu pay back the $55 million, was announced by Robert Capers, U.S. attorney for the Eastern District of New York.

A Turkish man who led a multinational cybercrime gang that stole $55 million by hacking ATM card issuers and making fraudulent cards was sentenced to eight years in prison by a federal court Friday.

The sentence, which also included a requirement that Ercan Findikoglu pay back the $55 million, was announced by Robert Capers, U.S. attorney for the Eastern District of New York in a statement.

Findikoglu pleaded guilty on March 1 last year to computer intrusion conspiracy, access device fraud conspiracy, and effecting transactions with unauthorized access devices. He was extradited from Germany in 2015 after being secretly indicted two years earlier.

Findikoglu was the hacker mastermind of the scheme, according to the indictment, gaining unauthorized access to the IT networks of card issuers on three occasions between 2011 and 2103 . In each case, Findikoglu, once he had obtained system administrator privileges in the system, would select certain prepaid debit card accounts, eliminate withdrawal limits on them and then distribute the account numbers, together with their PINs to trusted associates across the globe. They would then encode magnetic stripe cards with the compromised debit card data and distribute them to teams of “cashiers,” who used them to make fraudulent ATM withdrawals on a massive scale.

Because the gang always started by eliminating withdrawal limits, these cyberattacks were known as “unlimited operations,” Capers’ statement said.

In the third and final attack, in February 2013, the prolific gang made over 36,000 withdrawals in 24 different countries totaling about $40 million in only 10 hours. Nearly 3,000 of those withdrawals were in New York City totaling $2.4 million.

“Findikoglu was a skilled hacker who chose to use his considerable computer talents for criminal financial gain and to wreak economic havoc, rather than for legitimate pursuits,” said Capers. “Today’s sentence effectively neutralizes Findikoglu for years, and also should serve as a strong warning to those who seek to abuse their technical skills to breach the networks of trusted financial institutions.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure