Ukrainian National Who Co-Founded Cybercrime Marketplace Sentenced To 18 Years In Prison

BROOKLYN, NY – Earlier today, at the federal courthouse in Brooklyn, New York, Roman Vega, one of the world’s most prolific cybercriminals, was sentenced to 18 years in prison.  Vega, a Ukrainian national who co-founded the notorious Internet website CarderPlanet, pled guilty in 2009 to conspiracies to commit money laundering and access device fraud.  At the time of his arrest, Vega possessed over half a million stolen credit card numbers.

The sentence was announced today by Loretta E. Lynch, the United States Attorney for the Eastern District of New York; Acting Assistant Attorney General Mythili Raman of the Criminal Division of the Department of Justice; and Steven G. Hughes, Special Agent in Charge, United States Secret Service, New York Field Office. 

“Roman Vega and his cybercriminal associates emulated the mafia in organizing their criminal operations,” stated United States Attorney Lynch.  “Now, he shares the same fate as so many mafia bosses – a long term of imprisonment.  This investigation spanned the globe and sends the unmistakable warning that when it comes to dismantling global cybercrime organizations, neither distance nor complexity will deter us and our partners in law enforcement.”  Ms. Lynch expressed her grateful appreciation to the United States Postal Inspection Service for its assistance.

“Today’s sentence is a significant milestone in our ongoing effort to aggressively target and dismantle global cybercrime organizations that operate from every corner of the world,” said Acting Assistant Attorney General Raman.  “Vega helped create one of the largest and most sophisticated credit card fraud sites in the cybercrime underworld – a distinction that has earned him the substantial sentence he received today.”

“The Secret Service is pleased to have participated in this multi-agency criminal investigation that lead to the arrest of Roman Vega also known as ‘Boa’,” said Secret Service Special Agent in Charge Hughes.  “This case demonstrates by constricting this criminal enterprise, there is no such thing as anonymity in the cyber world.  The Secret Service continues to seek new and innovative ways to combat emerging cyber threats.  Our success in this case and other similar investigations is a result of our close work with our network law enforcement partners.”

Vega, who at various times was also known as “Boa,” “Roman Stepanenko,” “Randy Riolta,” and “RioRita,” formed two online marketplaces for stolen credit card information.  In the late 1990s, he founded the Boa Factory, one of the earliest websites on the Internet to provide a forum for buyers and sellers of stolen credit card information.  In the early 2000s, he co-founded and became a high-ranking administrator of a second criminal website, CarderPlanet, which became one of the first and busiest online marketplaces for the sale of stolen financial information, computer hacking services, and money laundering.

At its height, CarderPlanet had more than 6,000 members and had a hierarchical leadership structure that borrowed its leadership titles from La Cosa Nostra.  For example, CarderPlanet was headed by a “Godfather.”  Immediately below the Godfather were a number of “Dons,” including Vega, who used the name “Boa” when serving in this role.  Two levels below the Dons was the “Consigliere,” who was an advisor.  Vega, using the name “RioRita,” also served as the Consigliere.

CarderPlanet quickly became a premier online criminal bazaar in significant part as a result of Vega’s leadership.  Most notably, he helped institute a quality control system for sales.  If a cyberthief wanted to sell stolen credit card information on CarderPlanet, the information was subjected to a vetting process overseen by a manager to ensure that buyers obtained usable stolen data.  In addition, the website used e-currencies, such as WebMoney, to provide the participants with security and the cloak of anonymity.  As a result, Vega and his co-conspirators created an efficient and reliable online marketplace for the buyers and sellers of stolen financial information not unlike legitimate e-commerce sites.

Vega also sold stolen data on the marketplaces he founded and managed.  He directed cells of cybercriminals around the globe who hacked into financial institutions to steal credit card and other financial information that would in turn be sold on online marketplaces, including CarderPlanet. 

Vega was arrested in Cyprus in February 2003 and extradited to the Northern District of California for prosecution.  In November 2007, Vega was transferred to the Eastern District of New York following his indictment on the instant charges.  Vega has been incarcerated continuously since 2003.

The sentencing proceeding was held before Senior United States District Judge Allyne R. Ross.

The case was prosecuted by Assistant U.S. Attorney William P. Campos of the Eastern District of New York and Senior Counsel Thomas Dukes of the Criminal Division’s Computer Crime & Intellectual Property Section.

The Defendant:

ROMAN VEGA
Age: 49
Ukraine

E.D.N.Y. Docket No. CR-07-707 (ARR)