U.S. prosecutors on Tuesday unveiled criminal charges accusing three men of running a sprawling array of hacking and fraud schemes, including a huge 2014 attack against J.P. Morgan Chase, that generated hundreds of millions of dollars of illegal profit.
Gery Shalon, Joshua Samuel Aaron, and Ziv Orenstein were charged in a 23-count indictment over alleged crimes targeting 12 companies, including nine financial services companies as well as media outlets including the Wall Street Journal.
Prosecutors said the enterprise dated to 2007 and included pumping up stock prices, online casinos, payment processing for criminals, an illegal bitcoin exchange, and at least 75 shell companies and accounts around the world. Another defendant, Anthony Murgio, was charged over the bitcoin exchange.
“By any measure, the data breaches at these firms were breathtaking in scope and in size,” U.S. Attorney Preet Bharara said at a press conference.
Tuesday’s charges substantially expand a criminal case first announced in July. They are also the first tied to the J.P. Morgan (JPM) attack, which compromised information in 83 million customer accounts in what prosecutors called the largest theft of customer data from a U.S. financial institution.
Authorities said Shalon and Aaron executed that hacking, using a computer server in Egypt that they had rented under an alias that Shalon often used.
E*Trade Financial (ETFC), TD Ameritrade (AMTD), and News Corp’s (NWSA) Dow Jones unit, which publishes the Wall Street Journal, said they were also targeted by defendants in the case.
Fidelity Investments was also a target, a person familiar with the matter said, and Scotttrade was also a target, according to a law enforcement source.
Shalon, 31, and Orenstein, 40, are Israeli nationals who were arrested in July. Murgio, from Florida, was also arrested that month. Aaron, 31, is a U.S. citizen who has lived in Moscow and Tel Aviv.
J.P. Morgan on Tuesday confirmed that the latest charges relate to the 2014 attack, and said it continues to cooperate with law enforcement efforts to fight cybercrime.
E*Trade said it has contacted 31,000 customers who may have been affected. News Corp said the indictment relates to a breach that targeted subscribers, and which was disclosed on Oct. 9.
Lawyers for the defendants were not immediately available for comment.
