In November 2009, federal prosecutors alleged that a group compromised RBS WorldPay’s payroll debit-card security, altered account limits and coordinated a rapid ATM cash-out worth more than $9 million. The alleged withdrawals involved 44 counterfeit cards and more than 2,100 ATMs in at least 280 cities worldwide in less than 12 hours. Those figures came from the indictment announced by the U.S. Department of Justice (DOJ); they were allegations, not findings of guilt.
What prosecutors alleged happened
The DOJ said a federal grand jury in Atlanta indicted Sergei Tsurikov, Viktor Pleshchuk, Oleg Covelin and a person identified as “Hacker 3” on November 10, 2009. The charges arose from an alleged intrusion into the RBS WorldPay network, which processed payroll debit cards. According to the DOJ announcement, prosecutors alleged that the group:
- Compromised encryption used to protect customer data on payroll debit cards.
- Raised account limits, enabling larger withdrawals than the cards would otherwise have permitted.
- Provided cashers with 44 counterfeit payroll debit cards.
- Coordinated ATM withdrawals and the movement of proceeds.
Prosecutors said the cashers kept 30–50% of the money they withdrew, with the bulk sent back to defendants. These are claims in the 2009 announcement, not established findings about what each individual did.
How large was the alleged ATM cash-out?
The DOJ announcement said the cashers withdrew more than $9 million at over 2,100 ATMs in at least 280 cities worldwide in less than 12 hours. The scale and speed depended on coordinating many cashers and locations; the account-limit changes and counterfeit cards were alleged parts of that scheme.
#1 Best Overall
The DOJ also said the indictment sought criminal forfeiture of $9.4 million. That was the amount prosecutors sought to recover through the case, not a statement that the money was ultimately forfeited.
How many people may have had information exposed?
The alleged 44-card cash-out is not the same measure as the possible data exposure. A November 11, 2009 Dark Reading report said RBS WorldPay reported that personal information belonging to 1.5 million cardholders and other people may have been affected, and that Social Security numbers for up to 1.1 million people may have been accessed.
Rank #2
| Figure | What it describes | Attribution and qualification |
|---|---|---|
| 44 cards | Counterfeit payroll debit cards allegedly supplied to cashers | DOJ, 2009 indictment announcement |
| 1.5 million people | Cardholders and others whose personal information may have been affected | RBS WorldPay, as reported by Dark Reading in 2009 |
| Up to 1.1 million Social Security numbers | Numbers that may have been accessed | RBS WorldPay, as reported by Dark Reading in 2009 |
The exposure figures are company-reported possibilities from 2009, not a count of people whose information was confirmed stolen or misused in the alleged ATM withdrawals.
Who was indicted, and what did the charges mean?
In addition to the four defendants named in the network-intrusion case, the DOJ separately announced access-device-fraud indictments against Igor Grudijev, Ronald Tsoi, Evelin Tsoi and Mihhail Jevgenov. An indictment is a formal accusation, not a conviction. The DOJ release also described possible maximum penalties under the law at the time; those were potential consequences of charges, not sentences imposed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
The release’s characterization by Acting U.S. Attorney Sally Quillian Yates that the incident was “perhaps the most sophisticated and organized computer fraud attack ever conducted” was her assessment at the time, not an independently established ranking.
Why did the investigation involve several countries?
According to the DOJ, the investigation involved U.S. authorities and law-enforcement partners in Estonia, Hong Kong and the Netherlands. The alleged withdrawals were distributed across cities worldwide, while investigators pursued suspects and evidence across national borders. Assistant Attorney General Lanny A. Breuer credited international cooperation, particularly between the United States and Estonia, with making the charges possible.
Rank #4
What is known about the cases’ later outcomes?
The DOJ announcement establishes that the indictments were made in November 2009. The sources cited here do not establish the later disposition of every defendant’s case, so the charges and alleged mechanics should not be presented as convictions or as a complete account of the eventual legal outcomes.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
