Two Romanian nationals who were extradited to the US in May have confessed their involvement in a $10m scam aimed at stealing credit and debit card data from payment terminals at hundreds of Subway restaurants and other merchants across the US, according to the United States Attorney's Office.
Iulian Dolan, 28, of Craiova, Romania, pleaded guilty to conspiracy to commit computer fraud and two counts of conspiracy to commit access device fraud. Cezar Butu, 27, of Ploiesti, Romania, pleaded guilty to one count of conspiracy to commit access device fraud. Each agreed to plead guilty in return for lesser sentences as part of a plea-bargaining agreement that will see Dolan jailed for no more than seven years and Butu for no more than 21 months, providing a sentencing judge approves the deal.
The pair were among four Romanian nationals extradited in May after being charged last December with hacking into Subway vulnerable point-of-sale computers between 2009 and 2011. The scheme led to the compromise of more than 146,000 payment cards and more than $10m in losses.
The hack against point-of-sale terminals relied on identifying machines running exploitable remote desktop software applications. The US Dept of Justice said Dolan had hacked into these systems to install keystroke logging applications, which subsequently recorded card data from swiped cards before transferring this information to dump sites. In some cases Dolan had to crack passwords in order to circumvent the remote desktop applications, which in normal use were used to update the software on PoS terminals.
Butu has admitted to attempting to make fraudulent transactions using the stolen credit card data as well as selling the plastic cards data to co-conspirators. The confessions implicate alleged ring-leader Adrian-Tiberiu Opera, a Romanian national extradited to the US and awaiting trial in New Hampshire over his alleged involvement in the scam.
A US DoJ statement on the case can be found here. Subway is not named as the target of the scam by the DoJ in its latest statement but it is named in prior DoJ statements as being one of the victims of the hack – along with around 50 other merchants. ®