ANDREI TYURIN, a/k/a Andrei Tiurin Russian Hacker Gets 144 Months for WSJ, Chase Hack

January 8, 2021

ANDREI TYURIN, a/k/a “Andrei Tiurin,” was sentenced in Manhattan federal court to 144 months in prison for computer intrusion, wire fraud, bank fraud, and illegal online gambling offenses in connection with his involvement in a massive computer hacking campaign targeting Wall Street Journal, JP Morgan Chase investment bank, Fidelity Investments, E-Trade Financial and other American companies. TYURIN is charged with committing these crimes with Gery Shalon, a/k/a “Garri Shalelashvili,” a/k/a “Gabriel,” a/k/a “Gabi,” a/k/a “Phillipe Mousset,” a/k/a “Christopher Engeham,” Joshua Samuel Aaron, a/k/a “Mike Shields,” and Ziv Orenstein, a/k/a “Aviv Stein,” a/k/a “John Avery,” in furtherance of securities market manipulation, illegal online gambling, and payment processing fraud schemes perpetrated by Shalon, Aaron, Orenstein, and their co-conspirators. TYURIN previously pled guilty to these charges, and was sentenced today before U.S. District Judge Laura Taylor Swain.

Acting U.S. Attorney Audrey Strauss said: “From his home in Moscow, Andrei Tyurin played a major role in orchestrating and facilitating an international hacking campaign that included one of the largest thefts of U.S. customer data from a single financial institution in history, stealing the personal information of more than 80 million J.P. Morgan Chase customers. The conspiracy targeted major financial institutions, brokerage firms, news agencies, and other companies, and netted Tyurin over $19 million in criminal proceeds. Now Tyurin has been sentenced to 12 years in prison for his crimes.”

According to the allegations contained in the Indictments to which TYURIN pled guilty, other filings in this case, and statements made during court proceedings, including TYURIN’s guilty plea hearing:

From approximately 2012 to mid-2015, TYURIN engaged in an extensive computer hacking campaign targeting financial institutions, brokerage firms, and financial news publishers in the U.S. (including but not limited to J.P. Morgan Chase Bank, E*Trade, Scottrade, and the Wall Street Journal), and was responsible for the theft of personal information of over 100 million customers of the victim companies. TYURIN’s hack of J.P. Morgan Chase Bank alone resulted in the theft of personal information of over 80 million customers. TYURIN engaged in these crimes at the direction of his partner Gery Shalon, and in furtherance of other criminal schemes overseen and operated by Shalon and his co-conspirators, including securities fraud schemes in the United States. For example, in an effort to artificially inflate the price of certain stocks publicly traded in the U.S., Shalon and his co-conspirators marketed the stocks in a deceptive and misleading manner to customers of the victim companies whose contact information TYURIN stole in the intrusions.

In addition to the U.S. financial sector hacks, from approximately 2007 to mid-2015 TYURIN also conducted cyberattacks against numerous U.S. and foreign companies in furtherance of various criminal enterprises operated by Shalon and his co-conspirators, including unlawful internet gambling businesses and international payment processors. Nearly all of these illegal businesses, like the securities market manipulation schemes, exploited the fruits of TYURIN’s computer hacking campaigns. TYURIN’s hacking activity included the targeting of companies known to be used for email marketing campaigns, competitor online casinos, and a merchant risk intelligence firm based in the United States, in order for the co-conspirators to monitor the firm’s efforts to audit potentially criminal online credit card transactions on behalf of major credit card networks, and thus avoid detection of their own criminal schemes.

In furtherance of his hacking activities, TYURIN used computer infrastructure located across five continents, which he controlled from his home in Moscow, and maintained persistent access over extended periods of time to the victims’ networks, regularly refreshing the stolen data by repeatedly downloading information from these companies. And once his hacking activities were detected, TYURIN worked with Shalon to destroy the evidence of their criminal activity and undermine U.S. law enforcement’s efforts to identify and arrest them.

Through these various criminal schemes, TYURIN, Shalon, and their co-conspirators obtained hundreds of millions of dollars in illicit proceeds, and TYURIN himself earned over $19 million in profits from his hacking activity.

* * *

TYURIN, 37, of Moscow, Russia, pled guilty to one count of conspiracy to commit computer hacking, one count of wire fraud, one count of conspiracy to violate the Unlawful Internet Gambling Enforcement Act, and one count of conspiracy to commit wire fraud and bank fraud. In addition, TYURIN pled guilty to one count of conspiracy to commit wire fraud, and one count of conspiracy to commit computer hacking, from charges that were transferred from the Northern District of Georgia for purposes of his plea. In addition to the prison term, Judge Swain ordered TYURIN to serve three years of supervised release, and to pay forfeiture in the amount of $19,214,956. The Court will determine TYURIN’s restitution obligations at a hearing scheduled for April 6, 2021. TYURIN has been in U.S. custody since he was extradited from the country of Georgia in September 2018, and will commence serving his sentence immediately.

* * *

Ms. Strauss praised the investigative work of the FBI and the U.S. Secret Service, and expressed her sincere gratitude to the Chief Prosecutor’s Office of Georgia and the Ministry of Justice of Georgia for their support and assistance with the extradition proceedings. She also thanked the Securities and Exchange Commission, Homeland Security Investigations, the Financial Industry Regulatory Authority, the Office of International Affairs of the U.S. Department of Justice’s Criminal Division for its assistance with the extradition, and the Financial Services Information Sharing and Analysis Center, which significantly aided the investigation by facilitating information sharing among the victim institutions.

The prosecution of this case is being overseen by the Office’s Complex Frauds and Cybercrime Unit. Assistant U.S. Attorneys Eun Young Choi, Noah Solowiejczyk, and Sarah Lai are in charge of the prosecution.