U.S. prosecutors say Russian spies behind Yahoo data breach
WASHINGTON — The Russian spies wanted secrets; the hacker was motivated by money.
Together, they orchestrated one of the largest thefts of consumer data in history: pilfering detailed user information from more than 500 million Yahoo accounts, including those of diplomats, journalists, Russian officials and politicians critical of the Kremlin.
Meanwhile, the hacker searched through Yahoo emails for gift card codes and credit card numbers, while launching a massive spam campaign.
He even manipulated Yahoo’s search engine to steer those seeking information on erectile dysfunction to an internet pharmacy that paid him a commission.
One of biggest
On Wednesday, Justice Department officials unveiled a 47-count indictment against two Russian operatives for the Kremlin’s infamous Federal Security Service, or FSB, and a notorious Russian hacker in what authorities have described as one of the biggest data breaches in U.S. corporate history.
A second alleged hacker, accused of playing a more limited role in the conspiracy, was arrested Tuesday in Canada.
“The FSB officers used criminal hackers to gain information that clearly some of which has intelligence value,” said Mary McCord, the acting assistant attorney general for the Justice Department’s National Security Division.
“The criminal hackers used the opportunity to line their own pockets.”
Justice Department officials said it was the first time that they had charged Russian security officials in such a case.
Yahoo, the beleaguered Sunnyvale, Calif.-based internet company, disclosed the hack in September, saying that thieves in 2014 had pilfered names, email addresses, telephone numbers, dates of birth, passwords and some encrypted and unencrypted security questions and answers.
Custody won’t be easy
The number of user accounts affected was massive, even compared with other major data breaches. Yahoo has said it believed it was the victim of a “statesponsored” attack.
The indictment announced Wednesday, handed down by a federal grand jury in San Francisco, names Dmitry Dokuchaev, 33, and Igor Sushchin, 43, who were identified as the FSB officers; Alexsey Belan, 29, a Russian hacker who was indicted in 2012 and 2013 on federal computer fraud charges; and Karim Baratov, described as a 22-yearold Canadian hacker born in Kazakhstan.
Putting the Russian suspects in handcuffs will not be easy.
There is no extradition treaty with Moscow, and there is no reason to believe the Kremlin will want to hand over its spies and citizens to face charges in the United States.
However, the officials said, they believe that such charges are useful for sending a message that adversary nations will face consequences for targeting U.S. companies for traditional spying or financial gain.
In that way, the case bears some similarities to the one levied against five Chinese military officers in 2014 who were accused of engaging in economic espionage against U.S. companies and a labor union.