Two arrested in Wales for credit card theft costing $3 million

March 24, 2000
Web posted at: 3:06 PM EST (2006 GMT)

From staff reports

(CNN) -- Two 18-year-old British men were in custody Friday after an FBI probe of millions of dollars in credit card theft through the hacking of e-commerce sites led investigators to Wales.

The men allegedly used the screen name "Curador" to intrude into nine e-commerce Internet Web sites in the United States, United Kingdom, Canada, Thailand and Japan.

The FBI said the theft involved credit card information from more than 26,000 accounts. The stolen credit card information was disclosed on the Internet. Losses could exceed $3 million, authorities said.

The FBI said no decision has been made on what charges may be filed in the United States or when they may be filed.

	MESSAGE BOARD
Insurgency

The handle "Curador" has become synonymous with stolen credit cards in the last month, as several small e-commerce sites were infiltrated and credit card information stolen. The card numbers were then placed for public display on a Web site signed by "Curador: The Saint of E-Commerce?".

Curador's victims included Promobility, a wireless phone merchant in Ontario; SalesGate.com in Buffalo, New York; LTA Media LLC in Knoxville, Tennessee; and Feelgoodfalls.com in Denver.

The investigation has stretched from North America to Thailand, where authorities were investigating the infiltration of Shoppingthailand.com, said Chris Davis, a partner at Tyger Team Consultants Ltd., a security firm involved in the investigation.

Eric Geiler of Promobility said hackers got into their site through a two-year-old security hole in a Microsoft e-commerce software package.

Geiler said he's still puzzled as to why the hackers targeted Promobility.

"How the hell did he even find us? We are nobody. Why did he pick us?" Geiler asked.

Microsoft's security Web site shows that the software company published a patch for the problem in July 1998, and issued a second warning in July 1999.

Small e-commerce firms are becoming more frequent targets for hacking, as they are less likely to have the most up-to-date software and maintenance to protect sensitive data.

The arrests were made Thursday by the Dyfed-Powys Police Service in Wales. The two teen-agers were charged with violating a 1990 U.K. computer law. Local law prohibits disclosure of the names of the men in custody.

The FBI said the Royal Canadian Mounted Police, Internet security consultants, and the banking and credit card industries assisted in the investigation.

Most credit card customers find themselves less in danger from credit card theft, as card issuers cap fraudulent charges at $50. Merchants, however, have no such protection if stolen card numbers are used to purchase goods.

According to a recent survey by the Computer Security Institute, 273 businesses reported over a quarter-billion dollars in losses related to computer hacking last year.

CNN Justice Department correspondent Terry Frieden and CNN Interactive Technology Editor D. Ian Hopper contributed to this report.

Credit-card numbers stolen via known security hole
March 13, 2000
Sites lose credit-card data to cracker
March 8, 2000
Insufficient computer security threatens doing business online
February 23, 2000
Teens steal thousands of Net accounts
January 14, 2000
Rebuffed Internet extortionist posts stolen credit card data
January 10, 2000

F.B.I.
ProMobility

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.