Charges filed over alleged $100M inside trade hacking scheme

An alliance of U.S.-based stock traders and computer hackers in Ukraine made as much as $100 million in illegal profits over five years after stealing confidential corporate press releases, U.S. authorities said on Tuesday.

The charges mark the first time that U.S. prosecutors have brought criminal charges for a securities fraud scheme that involved hacked inside information, in this case 150,000 press releases from distributors Business Wire, MarketWired and PR Newswire.

"This is the story of a traditional securities fraud scheme with a twist — one that employed a contemporary approach to a conventional crime," FBI Assistant Director-in-Charge Diego Rodriguez said in a statement.

Prosecutors said that hackers based in Ukraine infiltrated press releases before they were due to be released by the distributors. They included those that traders had put on "shopping lists" of releases that they wanted, prosecutors said.

The hackers created a "video tutorial" to help traders view the stolen releases, and were paid a portion of the profits from trades based on information contained there, prosecutors said.

Nine people were indicted by grand juries in Brooklyn, New York, and in Newark, New Jersey, on charges that they made $30 million in illegal profits over five years starting around February 2010. Separately, a U.S. Securities and Exchange Commission (SEC) civil lawsuit charged many others and said that thefts of inside information resulted in more than $100 million in illegal profits.

"This case illustrates how cyber criminals and those who commit securities fraud are evolving and becoming more sophisticated," Paul Fishman, the U.S. attorney for New Jersey, said at a news conference. He called the hackers relentless and patient.

The distributors were not charged with any wrongdoing. Fishman said authorities received "fabulous cooperation" from them.

Representatives with PR Newswire, MarketWired and Business Wire could not immediately be reached or declined immediate comment.

The indictments said the news releases included sensitive corporate information such as financial results that would later become public. The news was passed to the traders, who made illegal trades in stocks and options based on the stolen information, and foreign shell companies were used to share the rewards, the indictments said.

Authorities said the scheme resulted in illegal profits on such companies as Acme Packet Inc, Align Technology Inc, Caterpillar Inc, Dealertrack Technologies Inc, Dendreon Corp, Edwards Lifesciences Corp and Panera Bread Co.

The indictment in Brooklyn charged four traders: Vitaly Korchevsky, 50, a former hedge fund manager from Pennsylvania; Vladislav Khalupsky, 45, of Brooklyn and Odessa, Ukraine; and Leonid Momotok, 47, and Alexander Garkusha, 47, of the U.S. state of Georgia.

A separate indictment made public in New Jersey charges Ivan Turchynov, 27, and Oleksandr Ieremenko, 24, two purported computer hackers who live in Ukraine; Pavel Dubovoy, 32, a trader from Ukraine; and Arkadiy Dubovoy, 51, and his son Igor Dubovoy, 28, traders from Georgia.

One indictment quotes online chats in which Ieremenko told Turchynov on March 25, 2012, that he had "bruted" the log-in credentials of 15 Business Wire employees, and told an unidentified recipient in Russian on Oct. 10, 2012, that "I'm hacking prnewswire.com."

Charges brought against the various defendants include securities fraud, and conspiracies to commit securities fraud, wire fraud and money laundering.

Five of the defendants were arrested early on Tuesday, prosecutors said: Arkadiy and Igor Dubovoy, Momotok and Garkusha at their homes in Georgia, and Korchevsky at his home in Pennsylvania. International arrest warrants were issued for the other four, prosecutors said.

The SEC lawsuit charged 32 people and corporate entities with civil fraud. The lawsuit seeks civil penalties and has already resulted in a court-ordered freeze of assets, the SEC said in a statement.

The securities regulator has brought a handful of civil lawsuits in the past against individual hackers tied to insider trading. But they were all smaller than the case unsealed on Tuesday and none previously resulted in criminal charges.

Reuters