NEW YORK — Some of the hottest tickets in town — to Broadway hits, Jay-Z and Justin Timberlake concerts, a New York Yankees-Boston Red Sox game — were snapped up by an international ring of cyber thieves who commandeered more than 1,000 StubHub users’ accounts to make big money by fraudulently buying tickets and reselling them, prosecutors said Wednesday.
Ten people around the world have been indicted or arrested in connection with the case, which involved more than 3,500 tickets and at least $1.6 million in unauthorized purchases of sought-after seats, some to sold-out shows or behind the Yankee Stadium dugout, Manhattan District Attorney Cyrus R. Vance Jr. said.
Additional Images
“Today’s arrests and indictment connect a global network of hackers, identity thieves and money-launderers” who targeted the leading digital marketplace for reselling event tickets, Vance said. The scheme spooled from Russia to London to Toronto to the New York area and even to Barcelona, Spain, where accused Russian ringleader Vadim Polyakov was arrested while vacationing earlier this month.
The case comes amid growing concern about data thieves targeting consumer giants, and it pointed up pitfalls customers may face in using one password in multiple parts of their online lives.
StubHub said it was alerted to “a small number of accounts that had been illegally taken over by fraudsters” last year, contacted authorities and gave the affected customers refunds.
While prosecutors said they weren’t certain how the alleged thieves got access, San Francisco-based StubHub said they got account-holders’ login and password information from key-loggers or other malware on the customers’ computers or from data breaches at other businesses. San Francisco-based StubHub, owned by eBay Inc., said there had been “no intrusions into StubHub technical or financial systems.”
In the last few years, such major companies as Target, LinkedIn, eBay and Neiman Marcus have been hacked. Since many customers use the same email and password on multiple websites, thieves can net a combination from one site that works in many others, data security experts say.
It’s like re-using “the same key for every lock in your life — especially if you’re giving that key out to everyone you meet,” says Joe Siegrist, the CEO of LastPass, which makes password-management software.
In the StubHub case, once the suspects had those digital keys, they were able to use the credit-card and other information stored in unsuspecting users’ accounts to buy tickets — some as pricey as a $994 pair of field-level seats to a St. Louis Rams-Houston Texans game, prosecutors said.
Buyers can download tickets directly to their StubHub accounts. Account-holders do get emails confirming their purchase; in some cases, those emails prompted customers to contact StubHub and report fraudulent buys, company spokesman Glenn Lehrman said.
After the buys, members of the ring re-sold the tickets and routed the money to others who laundered it, and the group split the profits, Vance said.
“This guy (Polyakov) is pretty much admitting he is a hacker,” one of the alleged fences, Daniel Petryszyn, wrote in an online chat, according to prosecutors. “These tickets are all profits … I will launder all the money they want.”
Petryszyn, 28, and another accused re-seller, Bryan Caputo, 29, pleaded not guilty Wednesday to money laundering and stolen property possession charges. Petryszyn, who works at a catering business, “has every intention of challenging these charges,” said his lawyer, Liam Malanaphy.
Caputo, who works at a restaurant company, simply re-sold some tickets, said his lawyer, Reginald Sharpe. “If they were stolen, he didn’t know that they were,” Sharpe said.
Polyakov, 30, was awaiting extradition, and it wasn’t immediately clear whether he had a lawyer. Three other men indicted in the Manhattan case hadn’t yet been arrested; two are in Russia. Meanwhile, authorities have arrested three suspected money-launderers in London and one in Toronto on local charges there.
Send questions/comments to the editors.
