The Subway Data Breach, A Millionaire Hooters Waitress and Grape-Flavored Romanian “Protection”
Written by Evan SchumanIt’s certainly not unusual in federal cybertheft cases for the feds to use honeypot tricks to get overseas suspects to bring themselves to the U.S. And in the case of the massive data breach that hit the Subway fast-food chain last year, the Secret Service acted no differently. But this particular tale of extradition—involving a made-up millionaire woman who waited tables at Hooters for the benefits and the enjoyable customers and one suspect who brought into the States “three very large boxes of grape-flavored Romanian” (protection, he said, for the benefit of avoiding SPAM filters. Suffice it to say, they were rubberized)—is a little odd.
The story, from KrebsOnSecurity, tells the strange tale of getting two of the accused Subway cyberthieves to come to the U.S. without needing to be extradited. One was tricked with the offer of a free casino weekend; he left the plane carrying some clothes, money, jewelry and those fruit-flavored tax-deduction preventers. Asked if they were really grape-flavored, the suspect’s lawyer, Michael Shklar, confirmed they were. How was he so sure? “They’re sitting in my own damn file room,” he offered. As for the millionaire Hooters waitress, not sure what the Secret Service was thinking. Maybe, “He’ll believe it, because it’s such a ludicrous thing to make up”?
Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code.
-Marc
