Chinese Military Personnel Charged with Computer Fraud, Economic Espionage and Wire Fraud for Hacking into Credit Reporting Agency Equifax / Indictment Alleges Four Members of China's People's Liberation Army Engaged in a Three-Month Long Campaign to Steal Sensitive Personal Information of Nearly 150 Million Americans (DOJ Release)Former Suburban Insurance Agent Charged With Fraud for Allegedly Swindling Money From Elderly Client (DOJ Release)
[T]he defendants exploited a vulnerability in the Apache Struts Web Framework software used by Equifax's online dispute portal. They used this access to conduct reconnaissance of Equifax's online dispute portal and to obtain login credentials that could be used to further navigate Equifax's network. The defendants spent several weeks running queries to identify Equifax's database structure and searching for sensitive, personally identifiable information within Equifax's system. Once they accessed files of interest, the conspirators then stored the stolen information in temporary output files, compressed and divided the files, and ultimately were able to download and exfiltrate the data from Equifax's network to computers outside the United States. In total, the attackers ran approximately 9,000 queries on Equifax's system, obtaining names, birth dates and social security numbers for nearly half of all American citizens.The indictment also charges the defendants with stealing trade secret information, namely Equifax's data compilations and database designs. "In short, this was an organized and remarkably brazen criminal heist of sensitive information of nearly half of all Americans, as well as the hard work and intellectual property of an American company, by a unit of the Chinese military," said Barr.The defendants took steps to evade detection throughout the intrusion, as alleged in the indictment. They routed traffic through approximately 34 servers located in nearly 20 countries to obfuscate their true location, used encrypted communication channels within Equifax's network to blend in with normal network activity, and deleted compressed files and wiped log files on a daily basis in an effort to eliminate records of their activity.
[B]eginning in 2008 and continuing until 2014, Lazar submitted applications for an elderly client in his 80s to purchase several annuities and a life insurance policy from the companies Lazar represented, according to an indictment returned in U.S. District Court in Chicago. Upon approval of the applications, the client paid hundreds of thousands of dollars in premiums and Lazar received commissions from the companies, the indictment states. In some instances, Lazar designated her daughter as the beneficiary of the annuities, falsely claiming that her daughter was the client's grandchild or great grandchild, the indictment states.Upon the client's death in 2014, Lazar attempted to fraudulently collect some of the client's annuity and insurance proceeds, the indictment alleges. She also submitted a phony power of attorney to the client's bank to fraudulently withdraw approximately $100,000 from his checking account, the indictment states.
[C]ardinal, an oil-and-gas penny stock company based in Dallas, Texas, lost control of its interest in two oil-and-gas leases in mid-2017 that accounted for nearly all of the company's revenue. Following the bad news, the complaint alleges that Cardinal and Crawford filed quarterly reports with the SEC that misrepresented to investors that the company still expected the leases to be part of its future business plans. While concealing the setback to the business, Cardinal and Crawford allegedly raised additional money from investors and misreported Crawford's stock ownership.