18 U.S.C. § 1028A
Aggravated Identity Theft
Key Facts
- Statutory Citation: 18 U.S.C. § 1028A.
- Official Offense: Aggravated Identity Theft.
- Jurisdiction: United States (Federal).
- Correlated across 5 primary case matters in this library.
Prosecutorial Elements in Cyber Cases
Applies when a defendant knowingly transfers, possesses, or uses a means of identification of another real person without lawful authority during computer fraud or wire fraud.
Statutory Sentencing Exposure
Mandatory consecutive term of 2 years imprisonment in addition to the sentence imposed for the underlying felony offense.
Representative Prosecution Cases (5)
U.S. v. Roman Seleznev (Track2 Point-of-Sale Carding)
Prolific cybercriminal (Track2) who hacked into more than 500 small businesses and restaurants across the United States, stealing millions of credit card numbers and generating tens of millions of dollars in illicit sales on automated carding portals.
U.S. v. Andrei Tyurin (JPMorgan Chase Data Breach)
Russian hacker who penetrated JPMorgan Chase and eleven other major U.S. financial institutions and media companies, stealing personal data belonging to over 100 million customers to fuel securities pump-and-dump schemes.
Operation Cookie Monster (Genesis Market Takedown)
Coordinated multinational takedown of Genesis Market, the world's most prominent illicit broker of stolen digital browser fingerprints, cookies, and compromised account credentials.
U.S. v. Wu et al. (Equifax PLA Unit 54th Research Institute)
Four military officers with the Chinese People's Liberation Army (PLA) 54th Research Institute charged with hacking into Equifax networks, stealing trade secrets, and exfiltrating personally identifiable information (PII) of roughly 147 million American citizens.
SEC v. Blackbaud, Inc. (Misleading Ransomware Disclosure)
Landmark Securities and Exchange Commission enforcement order against public cloud software provider Blackbaud for making materially misleading disclosures concerning a May 2020 ransomware incident, omitting that attacker had exfiltrated unencrypted donor bank account and social security information while asserting sensitive data was not compromised.