The 18-year-old suspects, who live in a small village of about 700 people in southwest Wales, were arrested yesterday and charged under Britain's Computer Misuse Act of 1990. The names of the suspects, who were released on bail, were not disclosed by British police.
The teenagers are accused of stealing information related to more than 26,000 credit card accounts and posting the numbers on the Web using the nickname "Curador," according to the Federal Bureau of Investigation. The Web sites hit were based in the United States, Canada, Thailand, Japan and Britain, the FBI said.
The bureau added that the losses connected with the computer break-ins could exceed $3 million.
As earlier reported by CNET News.com, a hacker going by the name of Curador claimed responsibility for at least eight Web site break-ins in four countries. All the sites were relatively small, ranging from e-commerce marketplace SalesGate.com to the American Society of Clinical Pathologists site.
In a letter posted online, the hacker claimed to have taken advantage of a known bug in Microsoft software to read sites' commerce databases and to download more than 23,000 credit card numbers.
The arrests were welcome news to the hacked sites--and to an e-commerce industry facing renewed concerns about online security and privacy. Several other high-profile incidents of online credit card theft have made headlines in recent months, and the memory of the massive distributed denial-of-service attacks which temporarily shut down sites including Yahoo and eBay is still fresh in people's minds.
Another incident, in which a hacker named "Maxus" obtained close to 350,000 credit card numbers from e-commerce site CD Universe and then tried to extort money from the Web company, also made headlines early this year.
One security consultant hired by a firm hacked by Curador said the case showed that even relatively inexperienced hackers, far from the mainstream of high-tech society, can do serious damage.
The hackers left a clear digital trail for investigators to follow, said Chris Davis, a Canadian security consultant with Tyger Team.
"Their sophistication level was very low," he said. "They were sophisticated enough to get into the sites. But obviously they were not as bright as they thought they were."
In each of the eight cases for which Curador took credit, a well-known bug in Microsoft's e-commerce software allowed the intruder to download credit card information from the Web sites' databases, the victims have said. In several of the cases, the hacker left a digital trail that pointed to a single Internet service provider in the United Kingdom and left an identical digital "fingerprint," Davis said.
Microsoft released a patch for the security hole in mid-1998, and it has since sent several bulletins to software users asking them to download and install it.
Curador also apparently registered several domain names using stolen credit card numbers and later used those names to post the numbers online, Davis said. A credit card used to register "e-crackerce.com" belonged to a Jacksonville, Fla., postal worker, Stacey Yaple, who reported the incident to the FBI after she saw Curador's site.
For the domain name "curador.com," also used to post the credit card information online, the hacker gave a fictitious company address in Swansea, Wales, a town just a few miles from the suspects' homes.
The arrests could help assuage the fears of some consumers worried about the safety of their financial information online, analysts said.
"I think anytime both consumers and retailers feel like government can actually do something about the problem, and that there are real penalties, then they will feel more confident shopping," said Jamie Lewis, CEO of the Burton Group, a high-tech consulting firm in Salt Lake City.
The case should underscore the need for businesses to ensure that all online security holes have been closed, analysts added.
Law enforcement officials have not made any arrests in several other high-profile cybercrime cases, including the CD Universe case and the denial-of-service attacks on Yahoo and others.
The days of relatively low pay and massive stock options may be over, as high-tech start-up executives now want big options packages along with fat salaries.
Lucrative options packages have long been used to lure top executives as a way to compensate for the increased risk of joining a young company at a relatively modest salary.
But as demand for top talent grows, tech executives are increasingly demanding, and getting, fat salaries as well.
"The typical story used to be a guy has started a business in his garage, and he can't pay his bills because the evil (venture capital) company isn't giving him enough," said Steve Hall, a managing director at Pearl Meyer & Partners, a firm that researches and designs executive compensation packages.
"Now there's so much VC money floating around out there that VC companies are willing to be quite generous in their compensation," he said.
George Shaheen, for example, abruptly left his top job at Andersen Consulting last September to join online grocer Webvan, which had not yet gone public. Not only did Shaheen receive a 5 percent stake in a company that currently has a market value of about $2.9 billion, but he also received an annual salary of $500,000.
"There are a lot of VC companies, a high employment rate, and a lot of competition for executive talent," said Jean Yaremchuk, chief operating officer of VentureOne, which this week released a survey that offers a glimpse into the hiring trends at nascent tech firms.
According to VentureOne's poll of 800 private companies that received venture funding, the average CEO in the information technology industry earns $200,000 in total compensation. The survey did not include the value of stock options.
While many of the results in the survey were expected, some surprises were found:
• CEOs at start-ups in the health care industry receive a median annual compensation of $220,000, about 10 percent more than CEOs in the technology industry.
• The higher pay is apparently a result of the high employee churn rate. The turnover rate in the health care services and consumer products industries is about 16 percent, compared with less than 6 percent in information services and about 10 percent in the software and semiconductor sectors.
• Silicon Valley, despite the high-cost housing and density of tech companies, did not offer the best pay for CEOs. The Potomac region on the East Coast topped the list at $225,000, followed by the Northwest ($203,000), Southern California ($200,000) and Northern California ($200,000).
VentureOne's report did not compare the results with previous years, but compensation experts noted that pay levels for CEOs are rising as tech start-ups proliferate.
"The general model used to be low pay with high equity," said Doug Friske, a principal at Towers Perrin who focuses on executive compensation. "You can't get away with that now."
"Either you belly up to the bar and pay the market rate, or you don't," he added.
The VentureOne survey also indicated little pay difference between venture-funded Internet companies and non-Internet companies. In fact, offline companies tend to pay more. The median compensation of a chairman and CEO of an online company is only $194,000, compared with the $233,000 paid to an "old economy" counterpart.
The real payoff for joining a dot-com company seems to be at the sub-CEO level. The survey found that vice presidents in Internet companies receive a higher premium for their services than their counterparts in non-Internet companies.
A vice president of product marketing in a VC-backed Web company gets 18 percent more salary than the median, and a vice president of clinical trials gets 40 percent more.
"VPs have a greater level of responsibility in technology companies," VentureOne's Yaremchuk said.
To explain the higher salaries of executives in the Potomac area, Yaremchuk said they "are not younger executives on their first start-up. They are typically older executives from government or defense positions with extensive technology backgrounds and a history of higher salaries."
Early investors are willing to pour money into start-ups and to pay high salaries because of the potential payoff when the company goes public.
"Right now there's a total embracing of VC-backed companies by investors," said Yaremchuk.
But that could change if companies continue to lose money.
"A lot of the run-up in pay is the result of market performance and not company performance," said Patrick McGurn, a director of corporate programs at Institutional Shareholder Service, which advises institutional investors on pay issues.
"No one is going to quibble over what General Electric pays (CEO) Jack Welch," he said. "The problem is the companies who reward their executives for a middling performance.
"My (institutional investor) clients are starting to look for executive compensation that's tied to company performance and not stock performance."
Play video
There are currently no comments for this post.