Two southern Californians are now facing charges for stealing 94,000 credit and debit card numbers from Michaels Stores Inc. customers in a prominent 2011 cyber attack affecting the largest U.S. arts and crafts retailer.
The charges against Angel Angulo, 25, of Riverside and Crystal Banuelos, 28, of Bloomington released Thursday by U.S. Attorney Paul Fishman in New Jersey, where Michaels also has stores.
RELATED STORIES
Cyber Arrest Frequency on Rise
FBI Takes Down Cyber Crime Forum
Estonian Man Guilty in Botnet Plan
Brothers Guilty in State Dept. Hack
The conspirators captured customers’ bank account information and personal identification numbers by installing devices on 88 point-of-sale terminals in 80 Michaels stores across 19 U.S. states, Fishman said.
With the help of others, Angulo and Banuelos then produced counterfeit bank cards, and used them to withdraw more than $420,000 from automated teller machines, Fishman said.
The scheme lasted from February to May 2011, when the defendants possessed 179 counterfeit cards in New Jersey, and affected seven banks including Bank of America Corp., JPMorgan Chase & Co., Toronto-Dominion Bank and Wells Fargo & Co., Fishman said.
Angulo and Banuelos each ended up charged with conspiracy to commit bank fraud, which carries a maximum 30-year prison term and $1 million fine, and aggravated identity theft, which carries a maximum two-year term.
It is unclear whether the defendants have hired lawyers. Angulo appeared Thursday in a Riverside federal court. Banuelos remains at large. A spokeswoman for Irving, TX-based Michaels did not immediately respond to requests for comment.
Eduard Arakelyan, now 24, and Arman Vardanyan, now 26, are serving five-year prison terms after pleading guilty in March 2012 to defrauding holders of 952 stolen debit cards.
Federal prosecutors at the time said those cards ended up linked to the 2011 theft that is the subject of Thursday’s prosecution. Arakelyan and Vardanyan were also from southern California.