COURT DOC: Ukrainian National Who Co-founded Cybercrime Marketplace Sentenced to 18 Years in Prison

One of the worlds most prolific cybercriminals was sentenced today to serve 18 years in prison for his role in co-founding the notorious website CarderPlanet. At the time of his arrest, Vega possessed more than half a million stolen credit card numbers.

Roman Vega, 49, a Ukrainian national, pleaded guilty in 2009 to conspiracies to commit money laundering and access device fraud. According to court documents, Vega who at various times was also known as ‘Boa,’ ‘Roman Stepanenko’ and ‘Randy Riolta’ conspired with others to steal large volumes of credit card information through hacking and other sophisticated means, and then sold that stolen information to others, who ultimately used the information to purchase merchandise and services. Vega founded two different online marketplaces for this stolen credit card information.

In the late 1990s, Vega founded the Boa Factory, one of the earliest websites to provide a forum for sellers of stolen credit card information to meet potential buyers. In the early 2000s, he co-founded and became a high-ranking administrator of a second criminal website, CarderPlanet, which became one of the first and busiest online marketplaces for the sale of stolen financial information, computer hacking services and money laundering.

At its height, CarderPlanet had more than 6,000 members and had a hierarchical leadership structure that borrowed its leadership titles from La Cosa Nostra. For example, CarderPlanet was headed by a ‘Godfather.’ Immediately below the Godfather were a number of ‘Dons,’ including the defendant, who used the name ‘Boa’ when serving in this role. Three levels below the Dons was the ‘Consigliere,’ who was an advisor. Vega, using the name ‘RioRita,’ also served as the Consigliere.

CarderPlanet became a premier online criminal bazaar in significant part as a result of Vegas leadership. Most notably, the defendant helped institute a quality control system for sales. If a cyberthief wanted to sell stolen credit card information on CarderPlanet, the information was subjected to a vetting process overseen by a manager to ensure that buyers obtained usable stolen data. In addition, the website used e-currencies, such as WebMoney, to provide the participants with security and a layer of anonymity. Vega and his co-conspirators thus created an efficient and trustworthy online marketplace for the buyers and sellers of stolen financial information not unlike legitimate e-commerce sites.

Vega also sold stolen data on the marketplaces he founded and managed. He directed cells of cybercriminals located throughout the globe who hacked into financial institutions to steal credit card and other financial information that would in turn be sold on carding forums, including CarderPlanet. Vegas criminal career was cut short when he was arrested in Cyprus in February 2003 and extradited to the Northern District of California for prosecution. In November 2007, Vega was transferred to the Eastern District of New York following his indictment on the instant charges, and he pleaded guilty in January 2009. Vega has been incarcerated continuously since 2003. (Source: U.S. Department of Justice)