Russian extradited to US over massive hacks of JPMorgan Chase, other US financial firms

• Andrei Tyurin, along with three other co-conspirators, targeted several major firms including JPMorgan Chase, Dow Jones & Co., and Fidelity Investments among others.
• The JPMorgan Chase hack saw the theft of personal information of 80 million customers - the largest theft of customer data from a US financial institution in history.

A Russian national accused of launching massive cyberattacks against JPMorgan Chase and other US financial firms has been extradited to the United States, officials said. The US Attorney's Office for the Southern District of New York announced Friday that Andrei Tyurin was extradited from the country of Georgia and expected to appear in federal court in Manhattan on Friday afternoon.

Tyurin, 35, was arrested on behalf of US authorities in Georgia for allegedly targeting major financial institutions, brokerage firms and financial news publishers such as JPMorgan Chase, Dow Jones & Co., and Fidelity Investments in a hacking campaign that lasted between 2012 to mid-2015. Prosecutors said more than 100 million customers were impacted by breaches of these companies.

The JPMorgan Chase hack saw the theft of personal information of 80 million customers - the largest theft of customer data from a US financial institution in history.

The hacking scheme was led by Israeli national Gery Shalon who is currently facing charges over the cyberattack along with co-conspirators Joshua Samuel Aaron and Ziv Orenstein. The group used the stolen information to further other crimes including securities fraud schemes in the US, officials said.

For instance, the attackers marketed certain stocks publicly traded in the US in a deceptive manner to customers of the victim companies whose contact information were stolen in the breaches. They also operated illegal internet gambling businesses and international payment processors, garnering hundreds of millions of dollars in illicit profits.

Tyurin has been charged with conspiracy to commit computer hacking, wire fraud, computer hacking, conspiracy to commit securities fraud, conspiracy to violate the Unlawful Internet Gambling Enforcement Act, conspiracy to commit wire fraud and bank fraud and aggravated identity theft. The most serious charges carry a maximum sentence sentence of 30 years in prison.

If found guilty, Tyurin could face up to 97 years in prison.

"Tyurin’s alleged hacking activities were so prolific, they lay claim to the largest theft of U.S. customer data from a single financial institution in history, accounting for a staggering 80 million-plus victims," Manhattan US Attorney Geoffrey S. Berman said in a statement. "As Americans increasingly turn to online banking, theft of online personal information can cause devastating effects on their financial well being, sometimes taking years to recover.

"Today’s extradition marks a significant milestone for law enforcement in the fight against cyber intrusions targeting our critical financial institutions."