Ukrainian National Who Co-founded Cybercrime Marketplace Sentenced to 18 Years in Prison

Co-founded Carderplanet, One of the First Online Marketplaces for Stolen Financial Data

One of the world’s most prolific cybercriminals was sentenced today to serve 18 years in prison for his role in co-founding the notorious website CarderPlanet.   At the time of his arrest, Vega possessed more than half a million stolen credit card numbers.

Acting Assistant Attorney General Mythili Raman of the Justice Department’s Criminal Division, U.S. Attorney Loretta E. Lynch of the Eastern District of New York, and Special Agent in Charge Steven G. Hughes of the U.S. Secret Service’s New York Field Office made the announcement after sentencing by Senior U.S. District Judge Allyne R. Ross of the Eastern District of New York.

Roman Vega, 49, a Ukrainian national, pleaded guilty in 2009 to conspiracies to commit money laundering and access device fraud.   According to court documents, Vega – who at various times was also known as “Boa,” “Roman Stepanenko” and “Randy Riolta” – conspired with others to steal large volumes of credit card information through hacking and other sophisticated means, and then sold that stolen information to others, who ultimately used the information to purchase merchandise and services.   Vega founded two different online marketplaces for this stolen credit card information.

“Today’s sentence is a significant milestone in our ongoing effort to aggressively target and dismantle global cybercrime organizations that operate from every corner of the world,” said Acting Assistant Attorney General Raman.  “Vega helped create one of the largest and most sophisticated credit card fraud sites in the cybercrime underworld – a distinction that has earned him the substantial sentence he received today.”

“The defendant and his group of cybercriminals emulated the mafia in organizing their criminal operations,” said U.S. Attorney Lynch.   “Now, the defendant shares the same fate as so many mafia bosses – a long term of imprisonment.   This investigation has spanned the globe and should send the unmistakable message that when it comes to dismantling global cybercrime organizations, we will not be held back by distance or complexity.”

“The Secret Service is pleased to have participated in this multi-agency criminal investigation that lead to the arrest of Roman Vega also known as ‘Boa’,” said Secret Service Special Agent in Charge Hughes.  “This case demonstrates by constricting this criminal enterprise, there is no such thing as anonymity in the cyber world.  The Secret Service continues to seek new and innovative ways to combat emerging cyber threats.  Our success in this case and other similar investigations is a result of our close work with our network law enforcement partners.”

In the late 1990s, Vega founded the Boa Factory, one of the earliest websites to provide a forum for sellers of stolen credit card information to meet potential buyers.   In the early 2000s, he co-founded and became a high-ranking administrator of a second criminal website, CarderPlanet, which became one of the first and busiest online marketplaces for the sale of stolen financial information, computer hacking services and money laundering.

At its height, CarderPlanet had more than 6,000 members and had a hierarchical leadership structure that borrowed its leadership titles from La Cosa Nostra.   For example, CarderPlanet was headed by a “Godfather.”   Immediately below the Godfather were a number of “Dons,” including the defendant, who used the name “Boa” when serving in this role.  Three levels below the Dons was the “Consigliere,” who was an advisor.   Vega, using the name “RioRita,” also served as the Consigliere.

CarderPlanet became a premier online criminal bazaar in significant part as a result of Vega’s leadership.   Most notably, the defendant helped institute a quality control system for sales.   If a cyberthief wanted to sell stolen credit card information on CarderPlanet, the information was subjected to a vetting process overseen by a manager to ensure that buyers obtained usable stolen data.   In addition, the website used e-currencies, such as WebMoney, to provide the participants with security and a layer of anonymity.   Vega and his co-conspirators thus created an efficient and trustworthy online marketplace for the buyers and sellers of stolen financial information not unlike legitimate e-commerce sites.

Vega also sold stolen data on the marketplaces he founded and managed.   He directed cells of cybercriminals located throughout the globe who hacked into financial institutions to steal credit card and other financial information that would in turn be sold on carding forums, including CarderPlanet.   Vega’s criminal career was cut short when he was arrested in Cyprus in February 2003 and extradited to the Northern District of California for prosecution.   In November 2007, Vega was transferred to the Eastern District of New York following his indictment on the instant charges, and he pleaded guilty in January 2009.   Vega has been incarcerated continuously since 2003.

The case was investigated by the U.S. Secret Service, with assistance from the U.S. Postal Inspection Service.   The case was prosecuted by Senior Counsel Thomas Dukes of the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney William P. Campos of the Eastern District of New York.