Employee stole and sold AOLsubscriber list to spammers

Last night an AOL software engineer in the US was arrested for stealing the company’s entire list of subscribers, that’s some 92 MILLION names, and selling it to a 21-year-old spammer resident in Las Vegas.

According to federal charges that have been laid in New York against Jason Smathers, an AOL employee, over the last 12 months he routinely and illegally entered AOL’s confidential database to access and abstract the names and location of AOL subscribers. He allegedly did so by illicitly using another AOL employee’s access and identification codes.

Smathers got hold of names, postal codes, email addresses and details of credit card types of AOL subscribers, but fortunately was not able to access actual credit card numbers. Had he been able to, who knows what massive trouble and fraud would have ensued?

It is further alleged that Smathers, who worked for AOL in its Washington DC offices, then sold the list to one Sean Dunaway in Las Vegas who then used it to spam his own online gambling business.

The charge sheet also says that once Dunaway had copied the AOL list for his own purposes, he then sold copies on to other spammers at US$25,000 a time.

The feds seem particularly and pruriently exercised by the fact that one of these spammers used the purloined AOL subscriber list “for the purpose of mass marketing on the Internet herbal penile enlargement pills.”

The charge sheet, which runs to an entertaining 13 pages in length, (it’s on the web if you want to take a look) says that Smathers also sold Hathaway another, updated, AOL subscriber list, this time containing 18 million names, for a further $100,000.

AOL has suspicions that confidential details of their subscriber base were going astray and called in the FBI and US Secret Service to investigate. A covert examination of Smather’s laptop computer showed that he had been in contact with spammers and had been touting his idea of selling them AOL’s customer database since April 2003.

However, and intriguingly, it has emerged that to nail him the authorities engaged the services of another known spammer who is alleged also to have been involved in the AOL scam.

In an elaborate sting operation, this person bought two lists of AOL subscribers from Dunaway and led the feds to Smathers.

Having turned stoolie, the FBI says the anonymous spammer is now “seeking leniency concerning his/her participation in the activities against AOL.”

Smathers and Dunaway have been charged with criminal conspiracy and, on conviction, face fines of $250,000 each and five years in the Big House.

In a statement, AOL said, “We deeply regret what has taken place and are thoroughly reviewing and strengthening our internal procedures as a result of this investigation and arrest." I’ll bet they are.