Two Russian Nationals Charged in Separate Indictments with Fraud and Other Offenses Related to Hacking Campaigns

NEWARK, N.J. – Two indictments were unsealed in the District of New Jersey today charging two Russian nationals – Aleksey Timofeyevich Stroganov and Tim Stigal – with fraud and related offenses in connection with a series of computer intrusions, U.S. Attorney Philip R. Sellinger announced.

According to the indictments:

Stroganov

From at least May 2007 through July 2017, Stroganov – aka “Aleksei Stroganov,” “flint,” “flint24,” “Gursky Oleg,” “Oleg Gurskiy,” and “Строганов Алексей Тимофеевич” – was part of a criminal conspiracy to hack into the computer networks of individuals and companies and steal, among other things, debit and credit card numbers and personal identifying information associated with the cardholders.

Stroganov and his conspirators harvested data associated with hundreds of millions credit card and banking accounts. To profit from the scheme, Stroganov oversaw a network of resellers and vendors, who Stroganov provided with access to databases containing personal identifying information and payment card data for hundreds of thousands of accounts. The vendors then sold that data over the dark net through cybercrime forums and dark net websites. The scheme resulted in losses to financial institutions exceeding $35 million.

Stroganov is charged with one count of conspiracy to commit wire fraud affecting a financial institution, three counts of wire fraud, three counts of bank fraud, and three counts of aggravated identity theft. The substantive and conspiracy charges of wire fraud are punishable by a maximum sentence of 20 years in prison and a maximum fine of $250,000, or twice the gross amount of gain or loss from the offense, whichever is greatest. The charges of bank fraud are punishable by a maximum sentence of 30 years in prison and a maximum fine of $1 million. The aggravated identity theft charges carry a mandatory sentence of two years in prison, which must run consecutively to any other term of imprisonment imposed by the court.

Stigal

From April 2014 to March 2016, Stigal, aka “Key” and “Тим Стигал,” was part of four separate conspiracies to traffic in stolen payment card information belonging to the customers of at least three different corporate victims located throughout the United States. In relation to one of the conspiracies, and in an attempt to extort one of the corporate victims, Stigal additionally transmitted a threat to impair the confidentiality of stolen personal data belonging to customers of the corporate victim if a ransom was not paid to Stigal.

Stigal is charged with four counts of wire fraud conspiracy, 12 counts of wire fraud, one count of computer fraud extortion, three counts of access device fraud, and three counts of aggravated identity theft. The substantive and conspiracy charges of wire fraud are punishable by a maximum sentence of 20 years in prison and a maximum fine of $250,000, or twice the gross amount of gain or loss from the offense, whichever is greatest. The charge of computer fraud (extortion) is punishable by a maximum of 5 years in prison and a maximum fine of $250,000. The access device fraud charges are punishable by a maximum sentence of 10 years in prison and a maximum fine of $250,000. The aggravated identity theft charges carry a mandatory sentence of two years in prison, which must run consecutively to any other term of imprisonment imposed by the court.

***

U.S. Attorney Sellinger credited special agents of the U.S. Secret Service, under the direction of Special Agent in Charge Aaron Hatley, with the investigation leading to the charges against Stroganov and Stigal. He also thanked special agents of IRS - Criminal Investigation,  under the direction of Special Agent in Charge Tammy Tomlins, with the investigation leading to the charges against Stigal.

The government is represented by Assistant U.S. Attorney Anthony P. Torntore, Chief of the U.S. Attorney’s Cybercrime Unit in Newark, and Assistant Deputy Chiefs William A. Hall Jr. and Adrienne Rose of the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS).

The charges and allegations contained in the indictments are merely accusations, and the defendants are presumed innocent unless and until proven guilty.