U.S. prosecutors have accused two Israelis and an American of conducting a three-year hacking enterprise aimed at financial institutions that included the massive 2014 theft of customer information from JPMorgan Chase.
A 23-count indictment unsealed Tuesday alleges Gery Shalon, Joshua Samuel Aaron, and Ziv Orenstein targeted the computer networks of nine financial services companies to further stock manipulation schemes that generated tens of millions of dollars in illicit proceeds.
The charges up the ante in a case that began in July when prosecutors charged the three men with securities fraud.
“These three defendants perpetrated one of the largest thefts of financial-related data in history,” U.S. Attorney General Loretta Lynch said in a news release, referring to the JPMorgan hack in which the personal information and data of 83 million individuals and small businesses were compromised.
Preet Bharara, U.S. Attorney for the Southern District of New York, said the alleged enterprise was “breathtaking in size and in scope.”
“The charged crimes showcase a brave new world of hacking for profit,” he said. “It is no longer hacking merely for a quick payout, but hacking to support a diversified criminal conglomerate. This was hacking as a business model.”
According to the indictment, the “massive computer hacking crimes” against U.S. financial institutions and financial publishers, including The Wall Street Journal, began in 2012. Shalon and Aaron allegedly executed the JPMorgan hack using a computer server in Egypt.
Sources told Reuters that Fidelity Investments and Scottrade were also targets.
“[I]n an effort to artificially manipulate the price of certain stocks publicly traded in the United States, Shalon and his co-conspirators sought to market the stocks … to customers of the victim companies whose contact information they had stolen in the intrusions,” the indictment says.
Shalon allegedly told an unidentified co-conspirator that for Americans, buying stock was like “drinking freaking vodka in Russia.”
The defendants are also accused of trying to extract nonpublic information from financial corporations, processing payment information for fake pharmaceuticals and fake anti-virus software, falsifying passports, and taking control of a New Jersey credit union.
Shalon and Orenstein, who are both Israeli citizens, were arrested in Israel in July, while Aaron, a U.S. citizen, remains at large.