AOL customer list stolen, sold to spammer- MSNBC

Hacks, Viruses, Scams & = Spam

AOL customer list stolen, sold to spammer

= Former employee charged with stealing subscriber list=

By Bob Sullivan

Technology correspondent=

MSNBC

Updated: 6:19 p.m.&nbs= p;ET June 24, 2004

A former AOL employee was charged Wednesday with steali= ng the Internet provider's entire subscriber list -- over 30 million consumers, and their 90 million screen names -- and selling it to a spammer.

The employee, a 24-year-old software engineer named Jas= on Smathers, was arrested Wednesday at his residence in Harpers Ferry, W.Va., = according to the U.S. Attorney's Office in the Southern District of New York. <= /p>

According to a complaint filed before Judge Andrew J. P= eck, Smathers accessed AOL's subscriber list in May 2003, then sold the list to 21-year-old Las Vegas resident Sean Dunaway for an unknown sum. Dunaway was also arrested Wednesday.

Authorities allege Dunaway used the list to promote his Internet gambling business, and then resold it to another spammer for $52,0= 00. That spammer, who isn't named in the complaint, eventually agreed to cooper= ate with authorities and fingered Dunaway to U.S. Secret Service Agent Peter Cavicchia, hoping for leniency from government prosecutors.

The unnamed spammer admitted to using the AOL e-mail addresses to send e-mail marketing herbal penile enlargement pills. The spa= mmer also told authorities than Dunaway claimed to be making $10,000 to $20,000 = per day from his Internet gambling business.

AOL said no users will be forced to change their e-mail address because of the theft. Instead, the company will simply continue to attempt to block spam before it hits users.

"What we are doing for consumers is cooperating wi= th law enforcement," said Nicholas Graham, AOL spokesman. "AOL membe= rs can rely on us to tighten our filters, get them more tools to fight spam, a= nd file lawsuits against spammers. Our anti-spam efforts are still hitting on = all cylinders."

Other perso= nal data also stolen
According to the complaint, information on AOL's 30 million subscribers is maintained in the company's "Data Warehouse," and access is limit= ed to a small number of employees. Smathers, who worked at the firm's Dulles office, didn't have access to the data, but he impersonated another employe= e to reach it, the complaint says.

Smathers, who had worked at AOL since 1999, got more th= an screen names, according to the complaint. He also allegedly stole related z= ip codes, credit card types and telephone numbers. But he did not get credit c= ard numbers, the complaint says, because they are stored separately by the comp= any.

A search of Smather's employee computer last month reve= aled electronic conversations he had with Dunaway describing the heist, accordin= g to the government. After stealing the entire screen name database in May 2003, Smathers went back and got an update in March 2004, taking another 18 milli= on screen names. Dunaway paid $100,000 to Smathers for the updated list, and l= ater sold it to the unnamed spammer for $32,000.

During their investigation, AOL technicians discovered a telling file on Smathers' computer, which included a conversation between Smathers and a correspondent named "The Brews." Initially, the correspondent complains that most spam lists include many fake and invalid = AOL addresses.

"Well . . . it would be different if you mailed current AOL members. But the lists I use, and others have used, are just collected lists where people have to enter their emails and all there is thousands and thousands of fake emails. If you have a database of REAL emai= ls, that were fresh, the ratio of sign ups would be sooo much greater. If you h= ave any ideas on bulk mailing with AOL lol let me know and I can get you a prog= ram set up in a heart beat. heh.”

To that, Smathers replied: "Well I’ll check = it out ... It isn’t going to be easy. I think I found the member database ... Just need to figure out how to get the SNs [screen names] it is spread = over like 30 computers ... You can’t talk about this."

But later, he added, "OK, I got it figured out ... there are going to be millions of them so, will take time to extract I will= do them a chunk at a time ... because 37 million accounts have up to 7 screen names per account I’d expect there to be around 100 million active sc= reen names4 maybe more."

Both face up to five years in prison, the complaint say= s.