Arrests made in StubHub hacking, money laundering

NEW YORK — Ebay’s online ticket exchange StubHub was targeted by hackers who used stolen passwords and credit card numbers to buy and sell thousands of tickets for pop-music concerts and Yankees games, New York authorities said.

Six men were indicted Wednesday, including two Americans arrested in New York and New Jersey, a third American who is wanted, two Russians whose whereabouts are unknown and a third Russian awaiting extradition from Spain, where he was detained in front of a Barcelona hotel while on vacation, Manhattan District Attorney Cyrus Vance Jr. said at a press conference Wednesday.

The scheme, including at least another four accused money launderers who were arrested separately in London and Toronto, shows criminals’ “sophistication and speed” requires international cooperation, Vance said. “Cybercriminals know no boundaries — they do not respect international borders or laws.”

The arrests follow last week’s report from New York Attorney General Eric Schneiderman that security breaches exposing customers’ personal information are growing and cost state businesses $1.37 billion last year. StubHub, based in San Francisco, was defrauded of more than $1 million, with the money laundered through British banks, according to Vance.

Two of the Russians stole personal data online and used it to buy tickets on StubHub for events including Elton John and Justin Timberlake concerts, the “Book of Mormon” on Broadway and prime seats at Yankees Stadium, Vance said. The three Americans were fences who re-sold the tickets online shortly before the events, he said. The third Russian helped launder the money abroad, Vance said.

The two Americans who were arrested were scheduled to be arraigned Wednesday in New York state court, and the third American indicted is expected to turn himself in soon, Vance said. Data from their Gmail accounts shows they knew the tickets were acquired illegally, he said.

Vadim Polyakov, 30, and Nikolay Matveychuk, 21, are charged with using stolen data to buy the tickets, according to a statement from Vance’s office Wednesday. Polyakov was detained in Spain, while Matveychuk hasn’t been apprehended, according to the statement. Sergei Kirin, 37, a Russian who advertised his money-laundering services online, also hasn’t been arrested, Vance’s office said.

Daniel Petryszyn, 28, Laurence Brinkmeyer, 29, and Bryan Caputo, 29, all U.S. citizens, are charged with possession of stolen property and money laundering, Vance said. Petryszyn was arrested in Manhattan and Caputo was detained in Hudson County, New Jersey, he said. Brinkmeyer, of Bergen County, New Jersey, hasn’t been arrested, according to the statement.

The investigation was carried out in cooperation with New York Police Department, City of London police and the Royal Canadian Mounted Police in a case spanning from Russia to New York, Vance said. A German bank was also used, he said.

The hackers obtained login and password information through data breaches of other websites and retailers, or by deploying malware on personal computers, StubHub said in a statement today. StubHub’s systems weren’t affected, the company said.

“We are pleased to see these cybercriminals brought to justice,” Glenn Lehrman, a StubHub spokesman, said in the statement.

StubHub said authorities “around the world” had been investigating organized crime targeting the ticketing industry.