📸 Photo

KINGPIN

attackers to make them stop. "Just so I know you guys are as good as I think you are," Patterson said, "could any of that have been you guys?"

Gorshkov—bundled in the heavy jacket he wore back home in Chelyabinsk, a bleak, polluted industrial city in the Ural Mountains—hedged for a minute and finally answered. "A few months ago we tried, but we found it's not so profitable."

The Russian was being modest. For nearly a year, small to midsized Internet companies around the United States had been plagued by extortionate cyberattacks from a group calling itself the Expert Group of Protection Against Hackers—a name that probably sounds better in Russian. The crimes always unfolded the same way: Attackers from Russia or Ukraine breached the victim's network, stole credit card numbers or other data, then sent an e-mail or a fax to the company demanding payment to keep quiet about the intrusion and to fix the security holes the hackers exploited. If the company didn't pay up, the Expert Group would threaten to destroy the victim's systems.

The gang had lifted tens of thousands of credit card numbers from the Online Information Bureau, a financial transaction clearinghouse in Vernon, Connecticut. The Seattle ISP Speakeasy had been hit. Sterling Microsystems in Anaheim, California, had been hacked, along with a Cincinnati ISP, a Korean bank in Los Angeles, a financial services company in New Jersey, the electronic payment company E-Money in New York, and even the venerable Western Union, which had lost nearly sixteen thousand customer credit card numbers in an attack that came with a $50,000 extortion threat. When music-seller CD Universe didn't give in to a $100,000 ransom demand, thousands of its customers' credit card numbers showed up on a public website.

Several companies wound up paying the Expert Group small amounts to go away, while the FBI did its best to track the intrusions. They finally zeroed in on one of the ringleaders, "subbsta," whose real name was Alexey Ivanov. It wasn't that hard—the hacker, convinced he was out of