Six indicted in alleged hack of StubHub customers' credit cards

Six indicted in alleged hack of StubHub customers' credit cards
Manhattan Dist. Atty. Cyrus R. Vance Jr. announces the indictments of members of an alleged international cyber-crime ring that targeted StubHub customers. (Justin Lane / EPA)

An international cyber-crime ring was able to take over StubHub user accounts to steal identifying information and use victims' credit cards to purchase tickets to concerts and sporting events, authorities announced Wednesday.

Six people were indicted in connection with the alleged scheme to defraud users on the popular online ticket marketplace. According to the Manhattan District Attorney's office, the proceeds were transferred through a global network of accomplices in the United States, Britain, Russia and Canada.


StubHub, an EBay subsidiary, allows customers to buy and sell tickets to concerts, sporting events and other live entertainment. The company, according to authorities, discovered that more than a thousand accounts had been compromised by hackers who were fraudulently hijacking users' credit cars.

StubHub implemented new security measures to stop the fraud, but authorities said the hackers were able to get around the new hurdles by using credit card information stolen from additional victims.

An investigation that included law enforcement agencies from across the world  traced the exchanges to Internet protocol addresses, PayPal accounts, bank accounts and other financial accounts used by the six people indicted.

A StubHub spokesman told the Los Angeles Times that the alleged hackers either got user names and passwords "from the breach of other websites (i.e. Target)" or through the use of keystroke loggers or malware installed on the users' computers.

"Our customers are our No. 1 priority. Once fraudulent transactions were detected on a given account, affected customers were immediately contacted by StubHub's Trust and Safety team and refunded any unauthorized transactions," the company said in a statement.

Vadim Polyakov, 30, and Nikolay Matveychuk, 21, allegedly illegally purchased more than 3,500 e-tickets that were sent to a group of individuals in New York and New Jersey to be resold within hours of events featuring Elton John, Justin Timberlake and Jay Z.

Daniel Petryszyn, 28, Laurence Brinkmeyer, 29, and Bryan Caputo, 29, allegedly resold the tickets they received from Polyakov. The proceeds, according to the district attorney's office, were divided among multiple PayPal and bank accounts.

Sergei Kirin, 37, a Russian national who allegedly advertised his money-laundering services online, owned one of these accounts and kept a percentage as a fee, prosecutors said.

Polyakov was arrested outside his hotel near Barcelona. Authorities did not immediately answer questions about the whereabouts of the other defendants.

On Wednesday, investigators executed search warrants in New York and New Jersey at the homes of Petryszyn, Brinkmeyer and Caputo.

The defendants were charged in New York State Supreme Court with a variety of offenses, including money laundering and grand larceny.

For more tech news, follow @RobertFaturechi