Dental practice hit by online thieves

Mar 29, 2010

Computer criminals stole more than $200,000 out of the online bank accounts of a Missouri dental practice on March 22, according to an article on krebsonsecurity.com, a blog written by Brian Krebs, a former Washington Post reporter who now covers online scams, data breaches, and related stories.

Dentists working at Smile Zone, a pediatric dental practice in Springfield, MO, told Krebs that the unidentified thieves sent at least $205,000 of the practice's money to nearly a dozen individuals around the U.S.

The money was allegedly taken in 11 different transfers, including three large wires. The attack was carried out with the help of "money mules" -- willing or unwitting individuals hired through Internet-based work-at-home job schemes who help the attackers launder the stolen money, according to Krebs.

Eric Hudkins, Smile Zone office manager, told Krebs that he had contacted the FBI but was told the agency won't open a case on a theft like this unless it is more than $500,000 in losses. The case will instead be included with a group of similar investigations being handled by an FBI task force in Omaha, NE.

"Businesses do not enjoy the same protections afforded to consumers hit by online fraud," Krebs wrote. "Generally speaking, banks will work with commercial customers to try and reverse any fraudulent transfers, but the chances of that succeeding diminish rapidly after the first 24 hours following unauthorized activity." In addition, banks are under no obligation to reimburse commercial customers victimized by this type of online fraud.

Smile Zone is still investigating how the thieves accessed the bank account. According to Krebs, in similar cases he has reported on, the victim's computer networks were hacked using a Trojan horse program known as Zeus or Zbot, which allows the criminals to tunnel back through the victim's PC and log into the target account without raising any red flags.

Krebs urges small and mid-sized business owners to build and use a dedicated computer system strictly for online banking.