U.S. Identifies Hacker-Linked Insider Trading Ring

Stay up-to-date with the latest developments in securities law through access to both news and all statutes and regulations. Find relevant corporate filings through a searchable EDGAR database. And...

By Keri Geiger

Aug. 11 — Exposing a new front in cybercrime, U.S. authorities broke up an alleged insider trading ring that relied on computer hackers to pilfer corporate press announcements and then profited by trading on the sensitive information before it became public.

In morning raids in Georgia and Pennsylvania, federal agents arrested five traders in the plot, while four others indicted on hacking and securities fraud charges are at large.

The suspected hackers, who are thought to be in Ukraine, allegedly infiltrated the computer servers of PRNewswire Association LLC, Marketwired and Business Wire, a unit of Warren Buffett's Berkshire Hathaway Inc., over a five-year period.

They siphoned more than 150,000 press releases including corporate data on earnings that could be used to anticipate stock market moves and make profitable trades, the U.S. said. The hackers passed the information to associates in America and Ukraine, who allegedly used it to buy and sell shares of dozens of companies, including Panera Bread Co., Boeing Co., Hewlett- Packard Co., Caterpillar Inc. and Oracle Corp., through retail brokerage accounts.

Money Shifted Offshore

Prosecutors said the men targeted more than 100 companies and made “approximately 1,000 inside the window trades.” Money was then shifted offshore through Estonian banks, according to one of two federal indictments unsealed Tuesday.

While U.S. prosecutors said the nine men netted $30 million, a broader lawsuit by the Securities and Exchange Commission listed more than two dozen individuals and companies as defendants in an alleged scheme that earned $100 million.

By way of comparison, Manhattan U.S. Attorney Preet Bharara described the $275 million insider trading case of SAC Capital Advisors LP portfolio manager Mathew Martoma as the biggest ever against a single person.

Cyber Realm

The prosecution's case, led by the U.S. Attorney's Office for the Eastern District of New York and the FBI, shows how insider trading has crossed into the cyber realm, exposing the vulnerabilities of financial markets in the digital age. Just as prosecutors deploy ever-more aggressive tactics like wiretaps to curb illegal trading, criminals have leapt past them with a simple ruse: Steal information instead of persuading others to share it.

It's also a great equalizer. No longstanding Wall Street connections are needed to glean advance information from companies.

Still, the arrests and dual indictments in Brooklyn and New Jersey are a significant victory for the FBI and prosecutors, who have been struggling to halt an increasing number of computer incursions that have publicly shaken Target Corp., Sony Corp. and JPMorgan Chase & Co., among other big companies.

Attorneys for the defendants couldn't be immediately reached for comment.

Unprecedented Scope

At a press conference in Newark, N.J., SEC Chair Mary Jo White joined Homeland Security Secretary Jeh Johnson, New Jersey U.S. Attorney Paul Fishman and Acting Brooklyn U.S. Attorney Kelly Currie to announce the charges.

“Today's international case is unprecedented in terms of the scope of the hacking at issue, the number of traders involved” and the number of securities and the amount of illegal profit, White said.

“Today's international case is unprecedented in terms of the scope of the hacking at issue, the number of traders involved,” the number of securities and the amount of illegal profit, SEC Chairman Mary Jo White said.

By concealing the scheme by spreading it across multiple accounts, they showed their “market savvy,” she said.

Inside Information

With defendants spanning two countries, it isn't yet clear who masterminded the idea to hack the firms and trade off the information.

The only professional U.S. trader arrested was Vitaly Korchevsky, who was picked up Tuesday morning at his home in Glen Mills, Pa., outside Philadelphia.

Korchevsky is described by the authorities as the linchpin of the markets strategy, having run a mutual fund and worked on Wall Street before starting his own hedge fund. He operated NTS Capital, which has made no filings since its initial one four years ago. It isn't clear if the fund is still in operation. NTS was named as a defendant in the SEC complaint.

Korchevsky was indicted in Brooklyn on five counts including conspiracy to commit securities and money laundering. Also named in that case are Vladislav Khalupsky, Leonid Momotok and Alexander Garkusha.

Caterpillar Earnings

In the indictment unsealed in Newark, prosecutors described a number of trades involving large purchases of shares made ahead of quarterly earnings reports. For example, at the beginning of 2012, Peoria, Ill.-based Caterpillar submitted to PRNewswire a prepared announcement stating that its profits for the previous year had risen 36 percent.

The announcement, which sat in the wire's server for less than 24 hours, was scooped up by the hackers and passed to the traders, according to the government. In this short window, they allegedly bought $8.3 million in Caterpillar stock and options. The announcement was then released publicly before the markets opened on Jan. 26.

The stock rose 2 percent from $109.05 to $111.31 that day. The traders closed out their position for a profit of about $1 million, prosecutors said.

A spokeswoman for Caterpillar didn't immediately return a call or e-mail seeking comment on the case.

Few Credentials

Named in the 23-count New Jersey indictment are five men: Ivan Turchynov, Oleksandr Ieremenko, Arkadiy Dubovoy, Igor Dubovoy and Pavel Dubovoy. They face hacking and securities fraud related charges.

Little is known about the men other than that they allegedly worked with others to siphon inside information out of several press wire firms.

They appear to have little or no financial credentials or obvious experience as traders. They work in real estate and construction and operate a myriad of LLCs that appear to be covers for their trading operations, according to public records.

Three of the defendants appear to be related: Igor, Arcadiy and Paval Dubovoy. Arkadiy and Igor, who are father and son, currently live in Georgia, while Pavel is thought by the government to be in Ukraine. The five men face counts of conspiracy to commit securities fraud and hacking.

Arkadiy Dubovoy, Igor Dubovoy, Momotok, and Garkusha were arrested Tuesday at their homes in Georgia and were scheduled to appear this afternoon before U.S. Magistrate Judge Alan J. Baverman in Atlanta federal Court. Turchynov, Ieremenko, Pavel Dubovoy, and Khalupsky remain at large.

The SEC filed a parallel lawsuit Tuesday in New Jersey federal court. In addition to the nine men, additional defendants included companies affiliated with them, foreign nationals, hedge funds and firms, most of which are based in Moscow.

The regulator said Korchevsky made about $17.5 million in illicit profits, while the Dubovoy men made more than $31 million.

The complaint described trading by the defendants based on illegally obtained releases from Radio Shack Corp. and Brocade Communications Systems Inc., among others.

Investigation Begins

The investigation began when prosecutors in Brooklyn and the FBI received a referral from the SEC about a pattern of suspicious trading by some of the defendants.

The U.S. Secret Service and federal prosecutors in New Jersey later began a separate investigation that focused on the foreign hackers, a person familiar with the matter said.

For more than two years, investigators unraveled the scheme and the trades, which continued until recently, say people familiar with the investigation.

Federal agents alerted the three wire services of the computer breaches, and the firms didn't disclose them publicly to allow the investigation to continue unimpeded, the person said.

Business Wire said Tuesday in an e-mailed statement that it has been cooperating with the Justice Department and has hired a cybersecurity firm to “conduct additional forensic testing of its systems, and to provide assurance that Business Wire's network is fully operational and secure.”

PRNewswire and Marketwired didn't immediately comment on the charges.

To contact the reporter on this story: Keri Geiger in New York at kgeiger4@bloomberg.net

To contact the editors responsible for this story: Sara Forden at sforden@bloomberg.net

To see the SEC complaint, go to http://op.bna.com/srlr.nsf/r?Open=jnaw-9zalj7.

To see the criminal case in the U.S. District Court for the Eastern District of New York, go to http://www.bloomberglaw.com/public/document/USA_v_Korchevsky_et_al_Docket_No_115cr00381_EDNY_Aug_05_2015_Cour.

©2015 Bloomberg L.P. All rights reserved. Used with permission


Request Securities & Capital Markets on Bloomberg Law