Dave & Buster's aids feds in indictments for ID theft

Nation's Restaurant News, May 19, 2008

WASHINGTON -- The federal government has charged three suspects, two of whom are in jails in Turkey and Germany, with hacking into computers at 11 Dave & Buster's restaurants last year and stealing credit and debit card information apparently used in a multimillion-dollar looting.

The full extent of financial losses are not known, but banks have lost at least $600,000 as the result of data stolen from a single branch of the chain, authorities here indicated.

A 27-count indictment, which a federal grand jury returned and a judge unsealed May 12 in Central Islip, N.Y., charges Maksym Yastremskiy, from Kharkov, Ukraine, and Aleksandr Suvorov, from Sillamae, Estonia, with various counts of wire fraud, identity theft and intercepts of electronic communications.

A one-count complaint charged Albert Gonzalez of Miami with wire fraud conspiracy related to the scheme.

The indictment alleges the three hacked into cash register terminals at the 11 Dave & Buster's units last May to acquire customers' credit and debit card information and then sold the data to others who made purchases on the accounts.

Dallas-based Dave & Buster's, which has 49 big-box dining and entertainment locations in the United States and Canada, has fully cooperated and assisted in the U.S. Secret Service investigation of the case, according to federal prosecutors in New York and the Justice Department's computer crime and intellectual property section.

The indictment alleges that Yastremskiy, also known as Maksik, and Suvorov, known as "Jonny-Hell," installed a malicious computer code called a "packet sniffer" on registers. The code was configured to capture data including customers' account number and card expiration date from the magnetic strip as information moved from the restaurants' point-of-sale servers through computers at the chain's Dallas headquarters to a data processor's computer system.

Dave & Buster's officials could not be reached for a comment on the extent of the data loss, but the Justice Department said that at one restaurant alone the packet sniffer captured data for about 5,000 credit and debit cards, eventually causing losses of at least $600,000 to issuing financial institutions.

Turkish officials arrested Yastremskiy in Turkey in July 2007, and he remains in jail there on potential violations of Turkish law. A formal request for his extradition to the United States has been made to the Turkish government.

At the request of U.S. officials, German police arrested Suvorov in March while he was visiting their country. He remains in jail there, pending German action on a formal U.S. extradition request.

U.S. Secret Service officials arrested Gonzalez in Miami this month.