Federal authorities have arrested a Maryland man who is accused of participating in a yearslong cybercrime operation described by prosecutors as “securities fraud on cyber steroids.”
Joshua Samuel Aaron, 32, of Potomac, Maryland, was arrested at John F. Kennedy International Airport in New York upon his arrival from Moscow on Wednesday, the Justice Department said in a statement.
Mr. Aaron and two Israeli co-defendants face charges related to what the Justice Department has called “the single largest theft of customer data from a U.S. financial institution ever.”
Federal prosecutors said Mr. Aaron is accused of helping to conduct a massive computer hacking operation whose victims included various financial institutions, brokerage firms and news publishers, in addition to millions of individuals who were indirectly affected as a result.
Notably, the three men are accused of infiltrating JPMorgan Chase & Co., the largest bank in the United States, and stealing data pertaining to more than 83 million of its customers.
In announcing charges against the trio in June 2015, Preet Bharara, U.S. attorney for the Southern District of New York, said the suspects conducted “the single largest theft of customer data from a U.S. financial institution ever” in accomplishing the JPMorgan hack. The names, addresses, phone numbers and other sensitive information of more than 76 million households and 7 million small businesses were compromised.
Additionally, prosecutors said, the men waged cyberattacks against dozens of other major American companies. Though unnamed in charging documents, companies that have confirmed they have been targeted include Fidelity Investments Ltd., E*Trade Financial Corp., Scottrade Financial Services Inc. and Dow Jones & Co.
In compromising various facets of the financial sector, the defendants were able to manipulate the securities market in a manner that allowed them to generate millions of dollars in illegal profits, prosecutors said.
“For pursuing what we have called ‘hacking as a business model,’ and thanks to the efforts of the FBI and the U.S. Secret Service, Aaron will now join his co-defendants to face justice in a Manhattan federal courtroom,” Mr. Bharara said in a statement Wednesday.
A 22-count indictment unsealed in June 2015 charged Mr. Aaron and his co-defendants, Gery Shalon and Ziv Orenstein, with conspiracy to commit computer hacking, security fraud and aggravated identity theft, among other crimes. The two Israelis were extradited to the U.S. this year and pleaded not guilty upon being arraigned in June.
Authorities had a harder time apprehending Mr. Aaron, who entered Russia weeks before he was charged.
Officials say Mr. Aaron traveled to Russia from Ukraine in May 2015 and resided at an apartment near downtown Moscow until May, when he was jailed on charges of violating rules of his visitor’s visa.
Mr. Aaron unsuccessfully appealed that decision in June, and he was subsequently transferred to a detention center reserved for illegal immigrants, Bloomberg News reported this week.
Mr. Aaron waived extradition and asylum in Russia and voluntarily returned to the U.S. “to responsibly address the charges,” his attorney, Ben Brafman, told CBS.
He pleaded not guilty in court Wednesday to 16 counts related to the market manipulation scheme.
If convicted on all counts, he could face a maximum penalty of 117 years in federal prison, according to NBC News.