Stratfor Breach Leads To Over $700k In Fraud 68
wiredmikey writes "It isn't often that after a data breach involving credit cards, the public is given information on the exact amount money lost by consumers as a result. Thanks to the FBI, however, we now have a better understanding of what 60,000 stolen credit cards translates to financially, as this data was included in their investigation notes while working the Stratfor case. The last time the public had something close to actual stats from the source, we learned that the TJX breach cost Visa $68 million in 2007, two years after the TJX network was compromised by Albert Gonzalez. Yet, those were Visa's estimates. Now, in the aftermath of the Stratfor breach, the FBI has attributed $700,000 worth of charge fraud to the 60,000 credit card records taken during the network compromise. AntiSec supporters walked away with 860,160 usernames and passwords, in addition to the credit card records."
So here we have the real motive (Score:5, Insightful)
Money.
Not "leaked documents" or "liberated intelligence."
Plain old fashioned credit card fraud.
Re: (Score:2)
Re: (Score:3, Insightful)
If you complete the circle here, it does come back to the consumer, via retailers who have to pay processing fees and price their goods accordingly.
In the end, the consumer always pays.
Re: (Score:3)
Well, no, they still have to respond to supply and demand. Factor in competition and... no, prices aren't going to be raised. If they could get away with it, they would have raised them anyway.
Re: (Score:2, Informative)
The merchants who processed the stolen cards will be the one bearing the cost. Stratfor will only be fined by the CC companies if they are found to have violated industry rules (PCI compliance, etc.)
Re: (Score:3)
Given that the info is released by the organization that arranged the action ( and could therefore get some big negative publicity for it ) , I dont think I trust the number at all.
Re: (Score:2)
Re:So here we have the real motive (Score:5, Informative)
No, I think the real motivation was ideological if you read the profiles of Hammond. He used the stolen numbers to donate to charity.
The problem is, he's an idiot who doesn't understand how credit cards work. Fraudulent charges to charities actually hurts them because they get fined when chargebacks occur. So they don't get to keep the money, they lose extra money on top, and VISA/MC have a habit of disconnecting you from the credit card system entirely if they get too many chargebacks.
It's really tough to imagine a nastier or more stupid thing to do than use stolen credit cards with charities.
Re:So here we have the real motive (Score:5, Interesting)
It's really tough to imagine a nastier or more stupid thing to do than use stolen credit cards with charities.
Maybe that was Hammond's whole idea. By feeding bogus credit-card donations to controversial charities like the Church of Scientology, ACLU, NRA, or Freedom From Religion Foundation, you could effectively DoS them, as far as their ability to take Visa/MC is concerned.
Re: (Score:2, Interesting)
I am confident that the NRA is not a charity. It is a political action committee.
Re: (Score:3)
Well I'll have to correct you about the NRA. It's not a Charity so calling it a controversial charity for a Political Action Organization is like Calling Superman a Wimp.
AFAIK - Scientology does qualify under the screwy U.S. Rules as a charitable religious organization so I'll let that one slide and no, the purpose wasn't to DoS them. It was to cut off their funding or get them investigated, which for Scientology couldn't happen to a nicer bunch of people.
Re: (Score:1)
Re:So here we have the real motive (Score:5, Interesting)
Re: (Score:3)
I don't know if there's the option to allow the charitable donations to stand and then refuse other charges; Technically it wasn't me who made the donation, yet I'd rather not cost the charity money for
Re: (Score:3)
Re: (Score:2)
Oh is that why AdSense nailed me for $1800?
Charity my ass. It was fraud.
Re: (Score:2)
Don't forget that this is the TJX breakin that this is talking about- Slashdot's munging the concepts together. TJX was purely about money by crooks from start to finish.
Re: (Score:1)
Note to self... Never post before having your IV injection of caffene.
Now, one wonders... How is it that Stratfor, a private intelligence gathering interest (They called it a "think-tank", it's not QUITE that sort of interest...), be having this sort of information within themselves. It should be noted that a lot of damning info came out of the breach recently that pretty much devastates the Democratic Party's existence and places the current Administration's existence at risk (Being caught out explicitl
Re: (Score:1)
What are you talking about? I didn't get that memo.
Re: (Score:2)
Me either. Considering the lack of trouble for Bush outright stealing two presidential elections, I wouldn't hold my breath, even if whatever the GP is frothing about is actually true.
Incorrect assumptions (Score:5, Informative)
Not "leaked documents" or "liberated intelligence." Plain old fashioned credit card fraud.
You have made several possibly incorrect assumptions [wikipedia.org] here:
1. That AntiSec was the only group to hack the card data
2. That AntiSec profited from this crime, either by committing the actual credit card fraud, or selling the card data to someone who did
3. That AntiSec is a monolithic group with a management structure that can command its minions to do/do not do/whatever with data they obtain therefore making the group responsible for the actions of an individual
Re: (Score:2)
you wouldn't just give the cc's away and publish what you did if your main point was to acquire cc numbers for fraud.
why is fbi releasing this data now? to make hacktivism seem like stealing, to justify why they spent a million dollars on operation takedown lulzsec(possibly more! check out how much fbi had personnel working on the case).
in any case.. stratfor is actually responsible for the fraud committed, they kept a data cache they didn't have authority to keep, keeping a db like that goes against all cc
Re: (Score:2)
you wouldn't just give the cc's away and publish what you did if your main point was to acquire cc numbers for fraud.
Yes I would. I would do it for two reasons:
First, it would let me claim that I committed the crime for altruistic reasons, which would feed my ego and let me pretend to be a hero instead of a crook. Anonymous's fans don't seem to need or want a serious moral or ethical justification for the crime; they're happy with a paper-thin pretext. It helps if you keep referring to the company you hi
Re: (Score:3)
Plain old fashioned credit card fraud.
No, It's spin. Anonymous looks like a douche and the public will buy the FBI story and never really hear about the real reasons behind the attack.
Pilfering the coffers has never been a primary motive behind Anonymous. Grabbing CC data is a way of gaining proof and leveraging control over the place you cracked. For the FBI however, It's much easier to build a legal case against the crackers by spinning the attack into a monetary motive. What sounds better in the news? "We're charging xxxx with trespassing an
The real losers (Score:5, Informative)
Re:The real losers (Score:4, Insightful)
Quite. And then the merchant is charged for a chargeback, so fraud is actually profitable for banks.
Once again the free market has produced the best solution... for the rich guy.
Re: (Score:2, Interesting)
The cost is passed on to everyone, not just credit card users
Even in places where charging extra for credit card usage is allowed (India), many merchants still prefer Credit cards for larger amounts since showing an ID is required, reduces the documentation work for the retailer(large cash transactions have a lot of paperwork involved) and its safer for the retailer since the money cannot be stolen
Online payments are also much more secure (though less convienient) in India as compared to US, but dont suppor
Re: (Score:1)
Beware those who say "incentivized" ... (Score:2)
Of course, you should compare and contrast that to the gargantuan amounts stolen by the banksters, sonny. Try that for a change!
Re: (Score:2)
Charge fraud is the new armed bank robbery (Score:5, Interesting)
Credit card fraud is a huge illegal industry. It finances drug gangs and cartels, terrorists, small organized crime, major organized crime (mafia), and occasionally the rogue individual hacker. It's the new form of armed bank robbery. Instead of guns they use computers though.
Of course while $700K in fraud by a few people is nothing to ignore, it is a bit ridiculous that the FBI devotes so many resources to catching these scumbags, while virtually ignoring the guys who swindle billions of dollars through stocks, insider trading, and pyramid schemes.
Re:Charge fraud is the new armed bank robbery (Score:5, Interesting)
Given lulzsec's generally loose-cannon approach, it isn't clear that the FBI had to put them up to it; but the FBI certainly did stand by and do some case building while they knowingly watched Stratfor and their customer lists burn... I'll be interested to see if that ends up being awkward for them in some way...
Re: (Score:2)
where are my mod points when I need them ... this sounds like they're downplaying it cuz fbi was a coconspirator here
Re:Charge fraud is the new armed bank robbery (Score:5, Insightful)
Re:Charge fraud is the new armed bank robbery (Score:5, Informative)
Not quite. The FBI also invetigate such cases - sometimes with the SEC sometimes without.
The funny thing is they've kicked it up in the last couple of years (with about 60 convictions), but the OP is too slow to notice:
http://www.cnbc.com/id/46623058/FBI_Expands_Crackdown_on_Insider_Trading [cnbc.com]
Re:Charge fraud is the new armed bank robbery (Score:4, Informative)
Credit card fraud is a huge illegal industry. It finances drug gangs and cartels
Illegal drugs are an incredibly lucrative business and don't need to be financed by credit card fraud. Do the anti-drug zealots think we're all that stupid? "Credit card fraud finances the drug trade" is just an incredibly brain-dead thing to say and even more idiotic to believe.
Re: (Score:2)
Credit card fraud is a huge illegal industry. It finances drug gangs and cartels, terrorists, small organized crime, major organized crime (mafia), and occasionally the rogue individual hacker.
Citation needed !
I doubt drug gangs, cartels, terrorists or any large organized crime use credit card fraud, since they have tons of money in other ways (drug and prostitution for example).
Credit card fraud is too random to be seriously useful for large groups.
But I'm also sure that small organized crime or individuals use it, since they just need to find mules.
The roaring 20's all over again? (Score:5, Interesting)
ehrm (Score:2)
It hasn't costed Visa that much, unless it's overhead costs.
Merchants don't get to keep fraudulent payments, VISA gets that money back. So only costs VISA would accrue is on the "overhead" bracket.
And the FBI Could've Stopped It (Score:1)
Considering what the cards were being used for... (Score:2)
...to pay Stratfor for intelligence crap....you really have to think "Live by the intelligence crap, die by it...."
Lots better than innocent people dying due to intelligence crap...
Albert Gonzalez (Score:3)
By day, he's a mild-mannered Attorney General [wikipedia.org]. By night, he becomes an uber-hacker who compromises Visa. Coolest duality ever.
Oh wait, we're missing an 'o' on the end. Never mind.
Just some FYI here (Score:2)
The leak happened in early December, but Stratfor did not notify its subscribers until December 24th. They offered a "free" subscription to CSID indentity protection service which, when activated, notified you that Yup, your username, password, and credit card number were hacked, something you could verify for yourself on the web. So there was at least a two week lag where they knew of the breach, but did not tell anyone so as to not "compromise" the FBI investigation. They SAID they notified the cc compani
One-time-use cards (Score:2)
I use Citi Mastercard for online purchases. Citi offers a "virtual account number" feature that can be used to generate a one-time-use number for a specific purchase. I've not had anyone yet attempt to use a number a second time, but if it happens they won't be successful, or so Citi claims.