HSI partners with NCA to identify 'SIM swapping' attack on US celebrities
International investigation leads to 8 arrests in cyberattack
LONDON — Homeland Security Investigations (HSI), in partnership with the UK’s National Crime Agency (NCA), conducted an investigation of SIM swapping attacks, which led to the arrest of eight men who illegally gained access to the phones of high-profile victims in the U.S.
The NCA-led investigation into these attacks identified numerous victims, including well-known influencers, sports stars, musicians and their families. On Feb. 9, eight suspected members of the criminal group aged 18-26 were arrested in England and Scotland.
NCA, HSI and U.S. investigators uncovered a network of criminals in the UK that hacked the victims’ phone apps and accounts by gaining access to their phone numbers. The perpetrators changed the password on the victims’ phones and were able to steal money, bitcoin and personal information. They also hijacked social media accounts to post content and send messages masquerading as the victim. NCA and U.S. investigators notified individuals when they had been targeted, and where possible, before the criminals managed to cause any damage.
“By gaining access to an individual’s phone number, you then ultimately have access to their bank accounts, email, social media accounts and their personally identifiable information,” said ICE Attaché for London, Eric Feldman. “This type of cybercrime is becoming far too common in our increasingly digital world. Homeland Security Investigations is proud to work side by side with our UK partners to disrupt transnational criminal activity and put a stop to these actors from continuing to cause havoc and financial damage to innocent people.”
“SIM swapping requires significant organization by a network of cyber criminals, who each commit various types of criminality to achieve the desired outcome,” said Paul Creffield, head of operations in the NCA’s National Cyber Crime Unit. “This network targeted a large number of victims in the U.S. and regularly attacked those they believed would be lucrative targets, such as famous sports stars and musicians. In this case, those arrested face prosecution for offences under the Computer Misuse Act, fraud and money laundering as well as extradition to the U.S. As well as causing a lot of distress and disruption, we know they stole large sums from their victims, from either their bank accounts or bitcoin wallets. Cyber criminality is not restricted by borders and our efforts to tackle it reflect that. This investigation is the result of successful collaboration with international partners in the U.S. and Europol, as well as our law enforcement colleagues here in the UK.”
SIM swapping involves cyber criminals using a victim’s phone number by deactivating their SIM and importing the allocated number over to a SIM belonging to a member of the criminal network. This is usually achieved when criminals exploit a phone service provider to perform the swap on their behalf, either by a corrupt insider or by using social engineering techniques. After gaining control of the phone number, they use the ‘change password’ function on the apps, and then receive a reset code sent via SMS (or to subsequently compromised email accounts) to reset the password. After changing the password(s), the victim is denied access and the criminals have free reign over their contacts, banking apps, emails and social media accounts.
The operation was coordinated by the NCA and involved officers from Police Scotland, the Metropolitan Police Service, East Midlands and North East Special Operations Units, and the West Midlands Regional Organized Crime Unit. The U.S. agencies involved included HSI, FBI, United States Secret Service and the Santa Clara County California District Attorney’s Office.
To report a crime, call 866-347-2423 (TTY for hearing impaired: 802-872-6196) or visit the ICE Tip Line.
HSI is a directorate of U.S. Immigration and Customs Enforcement (ICE) and the principal investigative arm of the U.S. Department of Homeland Security, responsible for investigating transnational crime and threats, specifically those criminal organizations that exploit the global infrastructure through which international trade, travel, and finance move. HSI’s mission is to investigate, disrupt and dismantle terrorist, transnational and other criminal organizations that threaten or seek to exploit the customs and immigration laws of the United States.
HSI’s workforce of over 10,400 employees consists of more than 7,100 Special Agents assigned to 220 cities throughout the United States, and 80 overseas locations in 53 countries. HSI’s international presence represents DHS’s largest investigative law enforcement presence abroad and one of the largest international footprints in U.S. law enforcement.
Updated: