iPhone 13 and 13 Mini review iPhone 13 Pro and 13 Pro Max review iOS 15's best features DoorDash alcohol delivery PS5 restock tracker Britney Spears back on Instagram

Prosecutor: Debit card crime ring busted

Authorities link 14 people to credit and debit card information that a prosecutor says was stolen from OfficeMax and other businesses.

A correction was made to this story. Read below for details.

Law enforcement officials in New Jersey have arrested 14 people in connection with a crime spree that has forced banks across the nation to replace hundreds of thousands of debit cards.

The suspects, all U.S. citizens, are accused of using stolen credit and debit card information to produce counterfeit cards that were used to make fraudulent purchases and withdrawals from card-holder accounts, Hudson County Prosecutor Edward DeFazio said. Most of the arrests were made during the past two weeks.

Some of the stolen credit card information came from the office-supply chain OfficeMax and other businesses, DeFazio told CNET News.com on Monday. "We had cooperation from the security people from many victimized businesses," he said.

Credit-card issuers Visa and MasterCard have blamed a growing number of thefts from debit-card holder accounts--in areas ranging from San Francisco to Boston--on a security breach suffered by a merchant, but they've refused to identify the company.

In the past two weeks, police conducting investigations in some of the regions hit by the fraud have discussed finding links between the victims and Itasca, Ill.-based OfficeMax, which has repeatedly denied suffering a breach. An OfficeMax representative was not immediately available for comment Monday.

Regardless of who is responsible for losing the data, the case could undermine the public's faith in debit cards, analysts say. While this isn't the first theft of debit cards, this is the first time thieves have snatched thousands of PIN codes, Gartner Research Director Avivah Litan said.

"This is the worst hack to date," Litan said. "All the other hacks were trying to get to this hack. All the previous hacks were leading up to finding a way into your bank account. For the criminal, this is the pot of gold."

Turning credit cards into cash is time consuming and costly for crooks, Litan said. With stolen credit-card data, thieves are forced to first buy goods and then fence the merchandise in order to generate cash.

"With this kind of debit-card fraud, they can go straight to the cash," Litan said.

An informant tipped off the Hudson County Sheriff's Department to the 14 who were arrested, DeFazio said, adding that the group has ties to criminal gangs residing overseas. Victims in the United States have reported discovering unauthorized charges or withdrawals in such places as Great Britain, Pakistan, Romania and Spain.

Hudson County sheriff's deputies launched their six-month investigation last June. Working with the New York City Police Department, sheriff's deputies began making arrests in December after finding the machinery allegedly used to create fake cards in a Manhattan commercial district.

As part of their investigation, Hudson County detectives served arrest and search warrants in Georgia, Massachusetts, South Carolina and Florida, DeFazio said.

"This was a sophisticated network," he said. "These guys have been around. It looks like they figured this was a safer way to generate cash, safer than dealing drugs or other crimes."

One of the accused ring leaders, Frank Robertson, was arrested last December and has already pled guilty to several fraud counts, DeFazio said. Robertson faces up to 15 years in prison when he is sentenced, DeFazio said. At the time of his arrest, Robertson was on parole for other credit-card fraud convictions, said DeFazio.

Correction: Due to incorrect information provided to CNET News.com, this story incorrectly stated the role of North Carolina's State Employees' Credit Union in the loss of of some customers' credit card information. Some members of the credit union were victims of credit card fraud, but the data was obtained from a third-party merchant.