Defendant Was the Principal Organizer of Cybercrimes That Netted More Than $55 Million in Proceeds for the Members of a Cybercrime Organization
Earlier today, at the federal courthouse in Brooklyn, New York, Ercan Findikoglu, a Turkish citizen also known by the online nicknames “Segate,” “Predator,” and “Oreon,” was sentenced to eight years for his leadership role in organizing and carrying out three cyberattacks on the global financial system between 2011 and 2013 that caused more than $55 million in losses. Findikoglu pleaded guilty on March 1, 2016, to computer intrusion conspiracy, access device fraud conspiracy, and effecting transactions with unauthorized access devices. In addition, as part of the sentence, the Court ordered Findikoglu to pay $55,080,226.14 in restitution. Today’s proceeding was held before United States District Judge Kiyo A. Matsumoto.
The sentence was announced by Robert L. Capers, United States Attorney for the Eastern District of New York, and David E. Beach, Special Agent in Charge, United States Secret Service, New York Field Office.
“Findikoglu was a skilled hacker who chose to use his considerable computer talents for criminal financial gain and to wreak economic havoc, rather than for legitimate pursuits. The defendant was responsible for hacking into computer networks of financial institutions across the globe and causing tens of millions of dollars in losses. Today’s sentence effectively neutralizes Findikoglu for years, and also should serve as a strong warning to those who seek to abuse their technical skills to breach the networks of trusted financial institutions,” stated United States Attorney Capers. Mr. Capers praised the extraordinary efforts of the Secret Service in investigating these complex network intrusions.
“Today’s sentencing brings one of the world’s most prolific cyber-criminals to justice,” stated Special Agent in Charge David Beach of the New York Field Office. “The relentless pursuit by the Secret Service and our international partners to identify and apprehend such criminals demonstrates the success of the law enforcement community to safeguard our nation’s financial infrastructure.”
According to public court filings, Findikoglu and his co-conspirators used sophisticated intrusion techniques to hack into the systems of credit and debit card processing companies, manipulated network administrator privileges at the victim card processing companies, manipulated account balances of prepaid debit cards to eliminate withdrawal limits on those cards, and stole the personal identification numbers (PINs) associated with the compromised debit cards. Findikoglu and his co-conspirators then disseminated the stolen card numbers and PINs worldwide to trusted associates who encoded magnetic stripe cards with the compromised debit card data. The associates then distributed these cards to teams of cashing crews, who used the cards to make fraudulent ATM withdrawals on a massive scale across the globe. As a result of the effective elimination of withdrawal limits, these cyber-attacks were known as “unlimited operations.”
Findikoglu organized and carried out three such unlimited operations. In the first operation on February 27 and 28, 2011, Findikoglu’s cashing crews withdrew approximately $10 million through approximately 15,000 fraudulent ATM withdrawals in 18 countries. In a second operation on December 21 and 22, 2012, Findikoglu’s cashing crews withdrew approximately $5 million through approximately 5,000 fraudulent ATM withdrawals in 20 countries. During this second operation, in New York alone, cashers conducted more than 700 fraudulent ATM withdrawals, totaling nearly $400,000 in losses, at more than 140 different ATM locations over the course of just two and a half hours. In a third operation on February 19 and 20, 2013, Findikoglu’s cashing crews withdrew approximately $40 million through approximately 36,000 fraudulent ATM withdrawals in 24 countries. During this third operation, in New York alone, cashers conducted nearly 3,000 fraudulent ATM withdrawals, totaling approximately $2.4 million in losses, over the course of approximately 10 hours.
Findikoglu was paid a significant portion of the illegal proceeds from these unlimited operations.
The government’s case is being handled by the Office’s National Security & Cybercrime Section. Assistant United States Attorneys Douglas M. Pravda, Richard M. Tucker, and Saritha Komatireddy are in charge of the prosecution. Assistant United States Attorney Brian Morris of the Office’s Civil Division is responsible for the forfeiture of assets. The Justice Department’s Office of International Affairs provided assistance.
The Defendant:
ERCAN FINDIKOGLU
Aliases: Segate, Predator, Oreon
Age: 35
Nationality: Turkish
E.D.N.Y. Docket No. 13-CR-440 (KAM)
