Ukrainian Hacker Gets 2 1/2 Years for Stealing News Releases

(Bloomberg) -- A Ukrainian hacker was sentenced to 2 1/2 years in prison for stealing unpublished news releases that helped a criminal network make $30 million trading securities with nonpublic information about corporate earnings.

Vadym Iermolovych, 29, was sentenced Monday in federal court in Newark, New Jersey, where he previously pleaded guilty to working with two other Ukrainian hackers to steal 150,000 releases from computer networks at PR Newswire, Business Wire and Marketwired. He was the fourth person to plead guilty in Newark or Brooklyn, New York, and the first hacker to do so.

U.S. District Judge Madeline Cox Arleo also ordered Iermolovych to pay $3 million in restitution. He pleaded guilty to conspiracy to commit wire fraud, conspiracy to commit fraud in connection with computers and aggravated identity theft. He had faced as many as 20 years in prison for the wire fraud conspiracy. In sentencing Iermolovych, Arleo gave him credit for cooperating with government investigators.

Hackers broke into computer networks at the three companies between February 2010 and November of 2014, stealing draft releases that they shared with others who made stock trades in advance of the public dissemination of the corporate earnings, prosecutors said. The hackers periodically moved among servers at the three companies as they were discovered and lost access to the releases.

In pleading guilty, Iermolovych said he bought a hacked database of stolen user names and logins for employees at PR Newswire. He said that by using credentials for one employee, he entered the company’s network on Feb. 27, 2013, and stole the releases.

Dark Web

Iermolovych also said he advertised on a dark Web forum that allowed people to gain access to stolen Marketwired releases before they were made public. He made tens of thousands of dollars by granting access to the stolen releases, he admitted in his guilty plea.

As part of his plea, Iermolovych said he worked with two Ukrainian hackers who remain at large, Ivan Turchynov and Oleksandr Ieremenko. They were among nine people whose charges were announced in August 2015 by federal authorities in Newark and Brooklyn. Prosecutors said evidence collected includes forensic images of laptops and computers seized by Ukrainian authorities in November 2012 from Turchynov and Ieremenko.

Iermolovych was first charged by the U.S. Secret Service on Nov. 5, 2014, in a separate case. Authorities said he resold hacked credit and debit card data on 600,000 accounts. He was arrested two days later and appeared three days after that in federal court in Houston, records show. He lived at the time with his mother.

The case is U.S. v. Iermolovych, 14-mj-3237, U.S. District Court, District of New Jersey (Newark).

To contact the reporter on this story: David Voreacos in federal court in Newark, New Jersey, at dvoreacos@bloomberg.net.

To contact the editors responsible for this story: David Glovin at dglovin@bloomberg.net, Joe Schneider, Paul Cox