Manhattan District Attorney Cyrus R. Vance, Jr., today announced the indictment of six individuals in connection with an international cybercrime ring that was able to take over StubHub, LLC (“StubHub”) user accounts, steal personal identifying information, use victims’ credit cards to make fraudulent electronic ticket (“e-ticket”) purchases, and transfer the proceeds through a global network of accomplices in the United States, United Kingdom, Russia, and Canada. The defendants are charged in New York State Supreme Court with varying degrees of Money Laundering, Grand Larceny, Criminal Possession of Stolen Property, and Identity Theft, among other charges.1
“Cybercriminals know no boundaries – they do not respect international borders or laws,” said District Attorney Vance. “Today’s arrests and indictment connect a global network of hackers, identity thieves, and money-launderers who victimized countless individuals in New York and elsewhere. The coordinated actions of law enforcement officials in New York, New Jersey, the United Kingdom, and Canada demonstrate what can be achieved through international cooperation. I thank all of our partners, including the City of London Police, Royal Canadian Mounted Police, the United States Secret Service, and the NYPD for their integral assistance with this investigation.
“Regardless of where the case originates, nearly every cybercrime case begins with similar breaches: a stolen password, unauthorized use of a credit card, or unaccountable charges on a personal statement, for example. In this case, StubHub discovered evidence of fraud and immediately reported it to law enforcement. I encourage anyone who believes that he or she may have been the victim of identity theft to call my Office’s Cybercrime and Identity Theft hotline at 212-335-9600.”
City of London Police Commissioner Adrian Leppard said: “This represents a milestone in the working relationship we have developed with the New York County District Attorney’s Office to target what is truly international organized crime. This is an important investigation, targeting cyber criminals who are believed to have defrauded StubHub out of $1 million, by hacking its United States’ customers’ accounts to fraudulently purchase and sell tickets, and then laundered their criminal profits through legitimate UK bank accounts. The coordinated arrests in New York and London highlight how law enforcement will work globally to protect legitimate businesses and consumers from cyber-enabled fraud through the relentless pursuit of suspected criminals.”
Inspector Andrew Cowan, Officer in Charge of the Royal Canadian Mounted Police’s London Detachment, said: “Organized crime is an international problem that cannot be fought solely within our borders. As such, the RCMP is committed to work diligently with our international partners to combat organized crime in all its forms. This investigation is an excellent example of the success that can be achieved through strong international partnerships.”
Special Agent in Charge of the U.S. Secret Service New York Field Office Robert J. Sica said: “Our Electronic Crimes Task Force partnerships have proven remarkably successful in detecting and suppressing computer-based crime. The successes of these partnerships have proven that it remains difficult for criminals to remain anonymous. The Secret Service will continue to pursue new and innovative ways to combat emerging cyber threats.”
StubHub Director of Trust and Safety Eric Boyles said: “StubHub would like to thank the New York District Attorney’s Office, the New York Police Department as well as the many participating law enforcement agencies around the world for their efforts in investigating organized criminal activity targeting the event ticketing industry and consumers at large. We are pleased to see these cyber criminals brought to justice as part of StubHub's continuing commitment to maintaining safe and open markets for fans to buy and sell tickets.”
According to the indictment, statement of facts, and documents and statements filed in court, in March 2013, StubHub, an eBay, Inc. subsidiary that operates a public website and digital marketplace for customers to buy and sell e-tickets to various entertainment events, discovered that more than 1,000 accounts were compromised by individuals who used the preexisting credit card information associated with the accounts to purchase tickets without the legitimate cardholders’ authorization. StubHub reported the fraud and immediately implemented security measures to prevent these intrusions, known as “Account Take-Over” fraud. However, investigators learned that the criminal ring was able to circumvent security protocols within the accounts by using new credit card information stolen from additional victims, instead of the original victims’ preexisting card information. After investigating the receipts and transaction records of more than 1,600 illegally accessed accounts, analysts in the DA’s Office were able to trace the exchanges to internet protocol addresses, PayPal accounts, bank accounts, and other financial accounts used and controlled by the indicted individuals.
VADIM POLYAKOV, 30, and NIKOLAY MATVEYCHUK, 21, are charged with using information taken from StubHub accounts and stolen credit card numbers to purchase more than 3,500 e-tickets that were sent to a group of individuals in New York and New Jersey to be resold within hours of an event. These events included some of New York’s most popular and sought-after events, such as concerts featuring Elton John, Marc Anthony, Justin Timberlake and Jay-Z; athletic events including Yankees baseball games, Giants and Jets football games, Knicks and Nets basketball games, Rangers hockey games, and the U.S. Open; and Broadway shows, such as Book of Mormon.
DANIEL PETRYSZYN, 28, LAURENCE BRINKMEYER, 29, and BRYAN CAPUTO, 29, are charged with reselling stolen tickets that they received from POLYAKOV and his associates. As instructed by POLYAKOV, criminal proceeds from the resale of stolen tickets were divided and directed to multiple PayPal accounts controlled by POLYAKOV and his associates, as well as multiple bank accounts in the United Kingdom and Germany.
One of these bank accounts belonged to SERGEI KIRIN, 37, a Russian national who advertised his money-laundering services online. POLYAKOV directed PETRYSZYN, BRINKMEYER, and CAPUTO to send payments to KIRIN, who retained a percentage of the money as his fee. Thousands of dollars were also split into separate payments and sent by wire transfer to other money-launderers in London, England and Toronto, Canada.
On July 1, the DA’s Office determined that Polyakov and a friend were traveling in Spain. Within hours of confirming his presence in the country, Interpol issued an international Red Notice for his arrest. Two days later, on July 3, Spanish authorities working with United States Secret Service agents arrested POLYAKOV outside of his hotel near Barcelona.
Today, investigators from the DA’s Office, NYPD, United States Secret Service, Bergen County, and Hudson County, executed search warrants in New York and New Jersey at the residences of PETRYSZYN, BRINKMEYER, and CAPUTO for additional evidence of their participation and involvement in the scheme.
Abroad, City of London Police detectives investigating what they suspect to be the proceeds of criminal activity being laundered through legitimate UK bank accounts arrested three men.2 The men, aged 27, 39, and 46, were arrested in London on suspicion of money laundering offenses and taken to local police stations for questioning. Royal Canadian Mounted Police (“RCMP”) also executed a search warrant and arrested an additional suspected money-launderer in Toronto.
The case represents the latest indictment in a series of investigations into international cyber-activity. In August 2013, the DA’s Office announced the convictions of 15 individuals indicted in connection with the Western Express cybercrime ring that extended from Ukraine to Brooklyn. The defendants were convicted of trafficking more than 95,000 stolen credit card numbers, resulting in more than $5 million in credit card fraud.
Consumer Protection Tips
Though cybercrime can seem pervasive and difficult to prevent, there are several precautions that individuals can take to help protect themselves and their assets. District Attorney Vance advises the following:
New Yorkers who believe that they may be the victims of a cybercrime scheme or intrusion are advised to contact our Office’s Cybercrime and Identity Theft Bureau hotline at 212-335-9600.
Assistant District Attorneys David Neeman and Sophi Jacobs are handling the prosecution of the case, under the supervision of Assistant District Attorney Jeremy Glickman, Deputy Bureau Chief of the Cybercrime and Identity Theft Bureau, Assistant District Attorney Brenda Fischer, Chief of the Cybercrime and Identity Theft Bureau, Assistant District Attorney Kenn Kern, Chief of Staff of the Investigation Division, and Executive Assistant District Attorney David Szuchman, Chief of the Investigation Division. Assistant District Attorney Amyjane Rettew, Appellate Counsel to the Investigation Division; Cybercrime Analysts Meredith Foster, Vitali Kremez, and Benjamin DiNapoli, all of the Cybercrime and Identity Theft Bureau; Principal Financial Investigator Michael Vecchio, of Forensic Accounting and Finance Investigations; and Senior Rackets Investigator Richard Breece, Supervising Rackets Investigator Robert Muldoon, Assistant Chief Rackets Investigator Michael Wigdor, and Deputy Chief Investigator Santiago Batista, all of the DANY Investigation Bureau, also assisted with the investigation.
District Attorney Vance thanked StubHub, PayPal, and eBay Inc. for their cooperation and assistance with the investigation, as well as the NYPD; RCMP, ‘O’ Division (Ontario), London Detachment Serious and Organized Crime, Financial Crime Team; City of London Police; Spanish Guardia Civil; Office of International Affairs; Bergen County Prosecutor’s Office; and Hudson County Prosecutor’s Offices. District Attorney Vance also thanked Detective John Munari and Captain Kenneth Gray, of the NYPD Financial Crimes Task Force; Supervising Special Agent Scott Sarafian, Special Agent LaMoine McCants, and Special Agent James Edwards, all of the United States Secret Service; and General Counsel Kevin R. Smith, Interpol, for their individual assistance.
VADIM POLYAKOV, D.O.B. 10/20/1983
DANIEL PETRYSZYN, D.O.B. 10/18/1985
New York, N.Y.
LAURENCE BRINKMEYER, D.O.B. 2/8/1985
Bergen County, N.J.
BRYAN CAPUTO, D.O.B 5/16/1985
Hudson County, N.J.
NIKOLAY MATVEYCHUK, D.O.B. 5/26/1993
SERGEI KIRIN, D.O.B. 6/7/77
 The charges contained in the indictment are merely allegations, and the defendants are presumed innocent unless and until proven guilty. All factual recitations are derived from documents filed in court and statements made on the record in court.
 The City of London Police is the National Policing Lead for Fraud in the UK. In this capacity the force hosts the National Fraud Intelligence Bureau which identifies serial fraudsters, organized crime gangs and emerging and established crime threats by analyzing millions of reports of fraud and cybercrime from the UK's national fraud and internet crime reporting center, Action Fraud. The force works in partnership with the National Crime Agency in the UK’s fight to cut serious and organized crime.