OPM Breach Leads to ID, Bank Fraud Guilty Pleas

Thieves plead guilty after targeting a Virginia credit union.

A sign stands outside of the Theodore Roosevelt Building, headquarters of the U.S. Office of Personnel Management (OPM), in Washington, D.C., Photographer: Andrew Harrer/Bloomberg

A Maryland woman pleaded guilty last week to participating in a scheme that used stolen identification information of victims from the 2015 U.S. Office of Personnel Management (OPM) data breach to obtain fraudulent personal and vehicle loans at the $2.6 billion Langley Federal Credit Union.

Karvia Cross, 39, of Bowie, was part of a fraudulent ID conspiracy ring that targeted the Newport News-Va.-based credit union.

In 2015, OPM publicly acknowledged that a network hack exposed the personal information of about 22 million former and current U.S. government employees. Reportedly, Chinese hackers managed to get into the OPM system in 2012, but they were not detected until March 2014.

Cross pleaded guilty to conspiracy to commit bank fraud and aggravated identity theft. Co-defendant Marlon McKnight pleaded guilty to the same charges on June 11. They face a maximum penalty of 30 years and a consecutive mandatory minimum of two years in prison. Four other individuals were also indicted for allegedly participating in the bank fraud conspiracy.

From December 2015 to May 2016, LFCU received numerous online membership and consumer loan applications using the names of stolen identities that were victims of the OPM data breach. The credit union approved and issued the requested memberships and loans before determining that fraudulent IDs were used to secure memberships and loans, the U.S. Attorney’s office for the Eastern District of Virginia, said in a prepared statement.

Although prosecutors do not say how much money was stolen, court documents show that more than $122,000 was pilfered through fake car and personal loans.

LFCU disbursed loan proceeds via checks and transfers into the checking and savings accounts opened through fraudulent applications. Vehicle loan proceeds were disbursed by checks made payable to individuals posing as vehicle sellers, while personal loan proceeds were disbursed to credit union accounts opened in connection with the fraudulent loan applications and transferred to accounts of others involved in the scheme. Cross and others withdrew the stolen funds, according to court documents.