New York: A Turkish man who led three cyberattacks against global financial institutions that caused more than USD 55 million in losses has pleaded guilty, prosecutors said.
Ercan Findikoglu, 34, whose online nicknames included “Segate,” “Predator,” and “Oreon,” entered the plea in Brooklyn federal court yesterday.
Prosecutors said he used cashing crews worldwide to make fraudulent ATM withdrawals on a massive scale across the globe.
In a February 2011 operation, Findikoglu’s cashing crews withdrew about USD 10 million through 15,000 fraudulent ATM withdraws in at least 18 countries, they said.
The government said he hacked into computer systems of three payment processing companies. It said he and co-conspirators accessed prepaid debit card accounts, inflated balances and removed their withdrawal limits between 2011 and 2013.
In a February 2013 attack, crews in 24 countries made 36,000 transactions, withdrawing about USD 40 million from ATMS, prosecutors said.
During one operation, they added, crews in New York City withdrew approximately USD 2.4 million from nearly 3,000 ATM withdrawals during an 11-hour period.
His lawyer hasn’t commented.
In a release, US Attorney Robert L. Capers called the cyberattacks massive.
“By hacking into the computer networks of global financial institutions, the defendant and his co-conspirators were able to wreak havoc with the worldwide financial system by simultaneously withdrawing tens of millions of dollars,” he said.
Findikoglu pleaded guilty to computer intrusion conspiracy, access device fraud conspiracy and effecting transactions with unauthorised access devices.
Although the charges carry a potential prison sentence of more than 50 years, Findikoglu is likely to face much less at a July 12 sentencing before US District Judge Kiyo A Matsumoto.
In a plea deal, the parties agreed that federal sentencing guidelines would call for a prison term of between 11 years and 15 years in prison, though he can request less.
He was arrested at Frankfurt Airport in 2013 before fighting extradition for more than 18 months. He was sent to the United States last year.
Secret Service Special Agent-in-Charge David E Beach said the prosecution showed “there is no such thing as anonymity in the cyber world.