Aleksandr Suvorov, of Estonia, has been sentenced to seven years in prison for his role in two separate hacking schemes involving a total of more than 240,000 stolen credit card numbers.
Suvorov, 28, an accomplice to Albert Gonzalez, one of the most prolific identity thieves ever prosecuted by the U.S. government, pleaded guilty in May 2009 to a wire fraud conspiracy charge for hacking into the national restaurant chain Dave & Buster’s and stealing more than 80,000 credit card numbers.
In addition, he pleaded guilty in November 2011 to a trafficking in unauthorized access devices charge related to the sale of more than 160,000 stolen credit card numbers to an undercover agent with the U.S. Secret Service. In addition to his prison term, Suvorov was ordered to pay $675,000 in restitution and to satisfy a $300,000 asset forfeiture judgment.
“Suvorov participated in a scheme to sell thousands of credit card numbers stolen from unsuspecting consumers,” said Assistant Attorney General Lanny A. Breuer. “Computer hackers like Mr. Suvorov victimize businesses and individuals, posing a serious threat to their financial security.” The sentence, he added, “sends a clear message that cyber criminals operating abroad will suffer severe consequences for their crimes.”
According to court documents, Albert Gonzalez and a third co-conspirator devised a scheme to gain unauthorized access into the computer systems of Dave & Buster’s for the purposes of installing malicious software and extracting credit card information of the Dave & Buster’s patrons.
Gonzalez, who was in Miami, sent the software, known as a “packet sniffer,” to a co-conspirator in Ukraine. A packet sniffer is malicious software designed, in this case, to collect credit card information. The co-conspirator in Ukraine then provided the packet sniffer to Suvorov in Estonia.
Suvorov, working with another individual, gained unauthorized access to 11 Dave & Buster’s restaurants throughout the United States, one of which was in Islandia, N.Y., and installed the packet sniffer. Suvorov and his co-conspirators ultimately obtained data from 81,005 credit cards.
Gonzalez was sentenced in March 2010 to 20 years in prison for his role in the Dave & Buster’s hack, as well as hacks into a major payment processor and several retail networks. The other co-conspirator was arrested in Turkey on related identity theft charges, and was sentenced there to 30 years in prison.
In a California case, Suvorov and an accomplice conspired to sell more than 160,000 stolen credit card numbers to a buyer in San Diego who was an undercover agent with the U.S. Secret Service. Suvorov provided the stolen credit card numbers to an accomplice, who in turn sold them to the undercover agent.