Iulian Dolan and Cezar Iulian Butu are two Romanian men that have admitted to participating in a conspiracy to hack into credit card payment terminals at over 150 Subway restaurant franchises. They stole data for over 146,000 accounts. The hacking spree took place between 2009 and 2011 and led to $10 million in losses for the company according to federal prosecutors.
Dolan (28) pleaded guilty to one count of conspiracy to commit computer fraud and two counts of conspiracy to commit credit card fraud according to court documents filed at a U.S. District Court in New Hampshire. Dolan admitted that he helped the alleged ring leader Adrian-Tiberiu Opera scan the Internet for point-of-sales systems. Dolan stole payment date from around 6,000 cardholders and will spend 7 years in prison.
“These were typically password-protected, so Dolan would attempt to crack the passwords, where necessary,” said Dolan’s legal team as part of a plea agreement, which was signed by the defendant. “Next, once he cracked the password and gained administrative access, Dolan remotely installed software programs called ‘keystroke loggers’ (or ‘sniffers’) onto the POS systems. These programs would record, and then store, all of the data that was keyed into or swiped through the merchants’ POS systems, including customers’ payment card data.”
Cezar Iulian Butu (27) pleaded guilty to one count of conspiracy to commit credit card fraud. As part of a separate plea agreement that was signed, Butu asked Opera to provide him with payment card data stolen through the spree. Butu had obtained data belonging to around 140 cardholders and he agreed to be sentenced to 21 months in prison. Opera will remain in custody by the U.S. government and is awaiting trial in the District of New Hampshire.