US federal officials have indicted four men, including two officers from Russia’s Federal Security Service, in connection with the online security breaches at Yahoo, and for stealing personal data that affected hundreds of millions of Yahoo users. The Russian men paid others to collect information through computer intrusions in the US and elsewhere. All four hacked into the computers of US companies providing email and internet-related services.
One, a Canadian and Kazakh national, was taken into custody in Canada, the authorities said. The other men are believed to be in Russia. There is no extradition treaty between Russia and the US, so US authorities will only be able to arrest them if they travel overseas to a country that is willing to hand them over.
The men used unauthorized access to Yahoo’s systems to steal information from about at least 500 million Yahoo accounts, starting in January 2014, according to the statement from the Department of Justice. They then used some of that stolen information to obtain unauthorised access to the contents of accounts at Yahoo, Google and other webmail providers, including accounts of Russian journalists, US and Russian government officials and private-sector employees of financial, transportation and other companies.
One of the Russians, Alexsey Belan was previously indicted in 2012 and 2013 and was named one of the FBI’s Cyber Most Wanted criminals in November 2013. An Interpol notice has sought his arrest since July 2013. Belan was hired by the two FSB officers to access the Yahoo database. Belan used his access to steal financial information such as credit card numbers from webmail accounts; to gain access to more than 30 million accounts whose contacts were then stolen to facilitate a spam campaign; and to earn commissions from fraudulently redirecting a subset of Yahoo’s search engine traffic.
The fourth co-conspirator, a resident of Canada, was tasked with accessing the accounts of targets of interest, at webmail providers other than Yahoo, by using information obtained as part of the Yahoo intrusion. He receieved commissions for obtaining unauthorized access to more than 80 accounts.
