A global ring of hackers and "cashers" twice used sophisticated cyberattacks to erase debit card limits and steal $45 million from ATMs in New York and around the world, each in "a matter of hours," federal prosecutors in Brooklyn charged Thursday.
Eight suspected members of a Yonkers-based New York cell of the global operation were charged with conspiracy and money laundering in a crime spree that officials called the largest bank heist in New York since the 1978 mob theft of $5 million in bank funds from a Lufthansa terminal at Kennedy Airport.
"The defendants and their co-conspirators participated in a massive 21st century bank heist that reached across the Internet and stretched around the globe," U.S. Attorney Loretta Lynch said at a news conference.
The ring -- believed to be based in Asia or Europe -- specialized in "Unlimited Operations," slang for invading financial networks, erasing withdrawal limits and accessing virtually unlimited proceeds, Lynch said.
Officials said the group secretly hacked into computers of credit card processors to remove limits on debit cards at targeted banks, then passed the account numbers to cell members around the world to encode on blank debit cards. At a chosen moment, "criminal flash mobs" began pulling cash from hundreds of ATMs, Lynch said.
Cells in 24 countries are suspected in a Feb. 19 operation that executed 36,000 ATM transactions in 10 hours to steal $40 million from the Oman-based Bank of Muscat, including $2.4 million in 3,000 withdrawals at ATMs in Manhattan and Queens by the New York defendants.
An operation in December netted $5 million globally and $400,000 in New York in less than three hours from Rakbank of the United Arab Emirates, the indictment stated. It also stated that funds were then laundered back to the masterminds, with local cells keeping about 20 percent and spending the take on Rolex watches and luxury cars.
The suspected head of the New York cell, Alberto Yusi Lajud-Pena, was found murdered in the Dominican Republic after the indictment was returned in April.
In one transaction, $150,000 in $20 bills was deposited into a Miami bank account controlled by Lajud-Pena, prosecutors said.
Authorities said agents recovered hundreds of thousands of dollars in cash and bank accounts, two Rolex watches and a Mercedes SUV. They said the Mercedes, along with a Porsche Panamera being seized, were purchased with $250,000 in cyberattack proceeds.
With Ellen Yan