The weird Florida connection in a massive bank data breach that impacted 76 million households

A sign outside the headquarters of JP Morgan Chase & Co in New York, September 19, 2013. JPMorgan Chase & Co will pay $US920 million in penalties in two countries to settle some of its potential liabilities from its Thomson ReutersJP Morgan Chase & Co sign outside headquarters in New York

Four arrests made on Tuesday in two separate cases — one involving penny stocks and the other an underground Bitcoin exchange — might tie back to last year’s massive cyberattack against JPMorgan Chase, Bloomberg News reports.

Two people were arrested in Israel and the other two were arrested in Florida. One person is still at large.

The JPMorgan cyberattack is not mentioned in any of the indictments.

What’s striking about these two separate cases is that they can be connected by a friendship that goes back a decade to Florida State University, Bloomberg News pointed out.

Anthony Murgio, 31, was arrested in Florida and charged with running an unlicensed Bitcoin exchange. He was also charged with one count of money laundering.

Joshua S. Aaron, a 31-year-old American citizen who resides in Tel Aviv and Moscow, faces multiple charges related to an alleged penny stock scheme. Aaron is the one who remains at large.

On what appears to be Murgio’s personal website, he mentions his friend Aaron, who he said “showed me the ropes to online marketing.”

Murgio and Aaron were both mentioned in an FBI memo from October 2014 regarding the JPMorgan hack, the Bloomberg report said. Bloomberg News noted that it was asked not to report about the memo earlier this year because it might impact the FBI’s investigation.

The JPMorgan breach

Last year, JPMorgan said that 76 million households and 7 million small businesses may have had their data compromised in a cyberattack. At the time, the bank said that that the hackers had access to customer names, addresses, phone numbers, and email addresses.

No customer money was lost. The bank also said there was no indication that account numbers, passwords, user IDs, dates of birth or Social Security numbers were compromised.

That attack was so massive though that it was even believed that the Russian government may have been behind it.

Millions of penny stock emails

Penny stock fraudUS DOJThese are the charges the trio faces.

The US Attorney’s Office in New York charged Gery Shalon, Joshua Samuel Aaron, and Zvi Orenstein for their roles in an alleged multi-million dollar penny stock pump-and-dump that goes back to 2011.

Shalon, 31, and Orenstein, 41, were arrested in Israel by the Israel Police.

Aaron hasn’t been arrested. Bloomberg pointed out that his wife shared photos on Instagram of them in St. Petersburg, Russia just a couple of days ago. We’ve also sent an email to Aaron seeking comment.

The Securities and Exchange Commission has also filed civil charges against the trio.

Shalon, who used the aliases “Phillipe Mousset” and “Christopher Engeham,” and Aaron, who went by “Mike Shields,” allegedly wrote emails that Shalon allegedly disseminated through “their possession of vast email lists,” the SEC said.
Orenstein, who went by “Aviv Stein” and”John Avery”, is accused of handling brokerage accounts using the aliases.

Authorities said that they sent spam emails to millions of people daily that contained “materially false” and “fraudulent” statements about the microcap companies based in Florida, Virginia, South Carolina, and California. They also allegedly used about 20 promotional sites to tout these stocks.

“These promotional campaigns frequently urged people to buy shares of the promoted issuers without properly disclosing that the promoters themselves owned shares of these issuers and, contrary to their exhortations to readers of their emails to buy shares, intended to sell those shares immediately,” the SEC alleged in its complaint.

The Florida arrests

The US Attorney’s Office in New York also arrested and charged Florida residents Anthony Murgio, 31, and Yuri Lebedev, 37, for allegedly running an unlicensed Bitcoin exchange that “exchanged at least $US1.8 million for Bitcoins on behalf of tens of thousands of customers.”

Murgio and Lebedev are accused of “knowingly operated, a Bitcoin exchange service, in violation of federal anti-money laundering (“AML”) laws and regulations,” the US Attorney’s Office in New York said.

Murgio and his co-conspirators are also accused of having “knowingly exchanged cash for Bitcoins for victims of ‘ransomware’ attacks, that is, cyberattacks in which criminals (here, distributors of the ransomware known as ‘Cryptowall’) electronically block access to a victim’s computer system until a sum of ‘ransom’ money, typically in Bitcoins, is paid to them.”

The US Attorney’s Office alleged that the pair hid the illegal exchange under the guise that they were operating a business called the “Collectables Club,” a members-only group for people to buy and sell collectibles like sports memorabilia.

Public records show a number of fictitious businesses registered to Murgio, including the “Collectables Club.” The records also show that in 2013 he was hit with felony charges for allegedly not paying $US110,000 in sales taxes for a a restaurant he owned.

NOW WATCH: People doing backflips on a two-inch wide strap is a real sport called slacklining

Business Insider Emails & Alerts

Site highlights each day to your inbox.

Follow Business Insider Australia on Facebook, Twitter, LinkedIn, and Instagram.