Ukrainian hacker admits stealing 150K press releases from newswire services to help criminal network make $30M from insider trading
Hacker, 28, broke into network after stealing user credentials — First hacker convicted in conspiracy to steal 150,000 releases
Context & Ripple Effects
This guilty plea is the first conviction inside a conspiracy prosecutors have been dismantling since the 2015 indictment of nine traders and hackers who allegedly tapped Business Wire, PR Newswire and other wires for five years. The 28-year-old's admission — stolen credentials, 150,000 unpublished releases, $30M routed through the trading network — converts that indictment into proven fact.
The arc keeps widening after this date: reporting later puts total illicit profits above $100M across three newswires, a Georgia man pleads guilty to wire fraud in the same case within months, and by 2019 authorities charge a separate crew for trading on earnings news hacked straight from an SEC database — showing the method outlived the original ring.
First-order effects
- Business Wire, PR Newswire and their corporate clients now have confirmed proof their embargoed earnings feeds were compromised at the credential level, forcing immediate access-control audits on every distributor sitting between issuers and markets.
- US prosecutors gain their first convicted conspirator in the newswire case, giving them a cooperating witness and a legal template for pursuing the remaining indicted traders.
Second-order effects
- Newswires face distribution-layer liability questions: when the pipe itself leaks pre-market information, wire services must price in breach risk or lose issuer trust to rivals claiming tighter controls.
- Regulators' attention shifts upstream from traders to the information infrastructure itself — a shift visible in the later charges against hackers targeting the SEC's own filing database.
Third-order effects
- If the pattern holds, any machine-readable pipeline carrying market-moving data before public release becomes a target class, pushing exchanges, wires and regulators toward treating embargo integrity as critical infrastructure rather than a PR workflow.
- The case also builds a cross-border enforcement precedent: US charges reaching Ukraine-based actors presages the kind of joint law-enforcement action seen in the later Ukrainian Secret Service arrest of a mass credential seller.
The trend: Market-moving information supply chains are becoming a contested attack surface, with each conviction extending enforcement from individual traders to the infrastructure that distributes earnings news.