DETROIT — This is an official press release from the U.S. Department of Justice (USAO - Michigan, Eastern), published as received.
DETROIT - A sixth member of an international hacking group known to its members as “The Community” was sentenced yesterday in connection with a multi-million-dollar Sim Hijacking conspiracy, announced Acting U.S. Attorney Saima Mohsin for the Eastern District of Michigan. This was the final defendant to be sentenced in the case, which was indicted in 2019.
U.S. Attorney Mohsin was joined in the announcement by Acting Special Agent in Charge James C. Harris of U.S. Immigration and Customs Enforcement’s Homeland Security Investigations (HSI) Detroit who oversees field offices in Michigan and Ohio.
Sentenced before United States District Judge Denise Page Hood was Garrett Endicott, 22, of Warrensburg Missouri. Endicott, who pleaded guilty, was sentenced to 10 months in prison and ordered to pay restitution in the amount of $121,549.37.
“SIM Hijacking” or “SIM Swapping” is an identity theft technique that exploits a common cyber-security weakness—mobile phone numbers. This tactic enabled The Community to gain control of victims’ mobile phone number, resulting in the victims’ phone calls and short message service (SMS) messages being routed to devices controlled by The Community. SIM Hijacking was often facilitated by bribing an employee of a mobile phone provider. Other times, SIM Hijacking was accomplished by a member of The Community contacting a mobile phone provider’s customer service—posing as the victim—and requesting that the victim’s phone number be swapped to a SIM card (and thus a mobile device) controlled by The Community.
Members of The Community engaged in Sim Hijacking to steal cryptocurrency from victims across the country, including California, Missouri, Michigan, Utah, Texas, New York and Illinois. Cryptocurrencies, also known as virtual currencies or digital currencies, are online media of exchange. The most famous of these is Bitcoin. Like traditional currency, they act as a store of value and can be exchanged for goods and services. They can also be exchanged for dollars.
Once “The Community” had control of a victim’s phone number, the phone number was leveraged as a gateway to gain control of online accounts such as a victim’s email, cloud storage, and—ultimately—cryptocurrency exchange accounts. The Community would use their control of victims’ phone numbers to reset passwords on online accounts and/or request two-factor authentication (2FA) codes that allowed them to bypass security measures.
In total, The Community’s scheme resulted the theft of tens of millions of dollars’ worth of cryptocurrency. Individual victims lost cryptocurrency valued, at the time of theft, ranging from under $2,000 to over $5 million. The sentenced defendants were involved in total thefts ranging from approximately $50,000 to over $9 million.
The following defendants have been previously sentenced in the Eastern District of Michigan, all after pleading guilty:
Ricky Handschumacher, 28, of Pasco Country, Florida, was sentenced to 48 months in prison and ordered to pay restitution in the amount of $7,681,570.03.
Colton Jurisic, 22, of Dubuque, Iowa was sentenced to 42 months in prison and ordered to pay restitution in the amount of $9,517,129.29.
Reyad Gafar Abbas, 22, of Charleston, South Carolina, was sentenced to 24 months in prison and ordered to pay restitution in the amount of $310,791.90
Two defendants charged in the indictment were previously sentenced in other courts. Conor Freeman, 22, of Dublin, Ireland, pleaded guilty to parallel charges in Ireland and was sentenced to three years in prison by an Irish court. Ryan Stevenson, 29, of West Haven, Connecticut, pleaded guilty and was sentenced to probation in the District of Connecticut. Both of these defendants were also ordered to pay restitution.
“The actions of these defendants resulted in the loss of millions of dollars to the victims, some of whom lost their entire retirement savings,” said Acting US Attorney Mohsin. “This case should serve as a reminder to all of us to protect our personal and financial information from those who seek to steal it.”
“The illegal activities of The Community were thwarted as the result of a complex international cryptocurrency and identity theft investigation,” said HSI Detroit Acting Special Agent in Charge James C. Harris. “As criminal organizations commonly use web-based schemes to further their illicit activities, this demonstrates how vulnerable our personal information can be, and the damage that can ensue when our information falls into the wrong hands.”
This case was investigated by HSI special agents with the assistance of Irish law enforcement authorities. The case was prosecuted by Assistant U.S. Attorney Timothy Wyse, assisted by Assistant U.S. Attorneys Shankar Ramamurthy and Michael El-Zein as well as attorneys from the Justice Department’s Office of International Affairs and Irish law enforcement officials. Special thanks are due to Assistant U.S. Attorneys and federal agents across the country that provided assistance with arrests and searches conducted on May 9, 2019.
