For eight months, O’Neill e-mailed Dolan, sometimes late at night from his home where he was on paternity leave with a baby boy. His wife was understanding: she’s an agent with the U.S. Federal Bureau of Investigation.
“Dolan seemed kind of like a lonely guy,” O’Neill said. “And, yes, there was some gentle flirting.” When Dolan finally walked off the plane in Boston on Aug. 13, 2011, he was carrying a gold necklace for “Sarah” and six boxes of grape-flavored condoms.
“He was being optimistic,” O’Neill said.
Meanwhile, O’Neill was also masquerading as “Chrissy,” a wealthy waitress for a restaurant chain known for its scantily- clad servers, who had met Butu during a recent sojourn through Europe.
Wealthy Waitress
O’Neill’s gambit this time was that “Chrissy” had enjoyed meeting Butu and hoped to re-establish contact. Eventually, “Chrissy” invited Butu to visit her in the U.S. Butu took the bait, arriving in Boston the day after Dolan.
“You tell them what they want to hear, within reason,” O’Neill said.
He took the traditional route with Oprea. The U.S. government sought the Romanian’s extradition. It worked: Oprea was arrested in December 2011 and sent to New Hampshire in May of last year.
All three pleaded guilty to hacking-related charges, admitting they hit more than 800 U.S. stores, about 250 of which were Subways. In interviewing Dolan and Oprea, O’Neill determined that they didn’t target Subway. It was just luck that so many got hacked. There are about 25,000 Subways in the U.S. and many had poor online security, O’Neill said.
As for the hackers, they didn’t make much profit -- Oprea, the ring leader, made only $40,000. He paid a steep price for the estimated $12.5 million in losses inflicted on financial institutions and the $5 million Subway spent upgrading its cyber security systems. Oprea was sentenced in September to 15 years in federal prison. Butu got 21 months behind bars, and Dolan received a 7-year sentence.