US Air Force members given over 6 years in prison for cyber theft of more than $2 million

Two members of the U.S. Air Force were handed multi-year prison sentences for running a business email compromise scheme that stole millions of dollars from several organizations.

Chijioke Timothy Odimegwu, 25, and Harafat Mogaji, 26, spent years sending phishing emails to businesses that allowed them to steal login information for employee email accounts. 

Using the stolen credentials and spoofed email addresses, the men redirected payments to and from victims into bank accounts they controlled. The men were stationed at Dover, Delaware Air Force base when they conducted the scams.

According to court documents, both men pleaded guilty to wire fraud, identity theft and access device fraud charges in June. 

The two were sentenced on Friday, with Odimegwu getting a more than 9-year sentence and Mogaji receiving a 6.5-year sentence. Odimegwu will pay $366,617 in restitution while Mogaji will have to pay $995,680. Each will also serve a three-year supervised release term after their prison sentence. 

Prosecutors said the two men worked with others to conduct attacks on at least 15 victim organizations, taking over email chains to steal payments between business partners. 

In one instance the two diverted a $1.7 million payment sent to a victim in Iowa. Prosecutors also found a $720,000 wire payment diverted from a victim in Ohio. After breaching email accounts, the two watched for discussions of payments and inserted themselves in the email chain, diverting business payments to their accounts by sending “updated” wiring information to victims.

Mogaji and Odimegwu also stole financial account information from victims that included account numbers, credit card data and debit card information, allowing them to either steal from the accounts themselves or sell the account access to other hackers. 

At times, the two used the stolen card information to make purchases themselves, trading the information with each other. 

They ran the scheme for more than two years before being caught by the FBI and local police officials. 

Mogaji and Odimegwu are the latest U.S. service members to face prison time for hacking campaigns after a former soldier in the U.S. Army was sentenced last week to more than five years in federal prison after pleading guilty to hacking into several telecommunications companies and leaking sensitive records.