An international crime ring that hacked into a ticket website and used customers' details to stage a million dollar fraud has been dismantled in a transatlantic crackdown involving British police.
More than 1,600 StubHub users were victims of the "sophisticated" scheme in which they had personal information stolen and their credit cards were used fraudulently to buy tickets, which were then sold on.
Some of the tickets were for gigs by Elton John, Justin Timberlake and Jay-Z, sports events including New York Yankees baseball games and the US Open, and Broadway shows such as The Book of Mormon.
The hackers' profits were then filtered away through a global network of accomplices in the US, UK, Russia, and Canada.
Today's operation involved City of London Police, Royal Canadian Mounted Police and the New York District Attorney's (DA) office, with the British force making three arrests.
The men aged 27, 39 and 46 were held on suspicion of money laundering after dawn raids in London and Suffolk. Canadian police arrested another alleged money launderer in Toronto, and Manhattan District Attorney Cyrus Vance said six people had been charged in the US.
Stephen Head, commander, National Co-ordinator for Economic Crime at City of London Police, said "a lot more" than one million US dollars could have been lost if the thieves had not been stopped.
"What we've got are really sophisticated cyber hackers, hacking into quite a well protected system in StubHub, getting into people's accounts, buying tickets, selling tickets, realising that money.
"And then the international dimension of course is the fact that they're trying to launder that money through London.
"The cooperation we've seen today is a model for future cooperation. These criminals operate without boundaries, we've got to be operating on that international dimension as well. It's the only way to be effective against these modern criminals."
According to its website, StubHub, an eBay company, is "a safe, convenient place" for fans "to get tickets to the games, concerts, and theatre shows they want to see, and an easy way to sell their tickets when they can't go".
The San Francisco-based firm said that the thieves did not break through its security - instead they got account-holders' login and password information from data breaches at other websites and retailers, or from key-loggers or other malware on the customers' computers, spokesman Glenn Lehrman said.
The company detected the unauthorised transactions last year, contacted authorities and gave the affected customers refunds and help to change their passwords, he added.
After investigating the receipts and transaction records of more than 1,600 hacked accounts, American analysts were able to trace the exchanges to internet protocol addresses, PayPal accounts, bank accounts, and other financial accounts used and controlled by the gang.
Commander Head said a lot of people expecting to go to events would never have got the tickets to go.
"This is international criminals targeting a very sophisticated company operating on the internet. They've been successful in one sense that they have hacked in - the good news is we've recognised it, working with our American counterparts, we've actually managed to arrest these people today," he said.
British police are building a "very strong relationship" with the DA's office in New York, Commander Head said.
"It's important for us to protect the integrity of London as a financial market and to work with New York in order to protect what are the two largest financial markets in the world. You would expect to see that cooperation.
"We know that international criminals who are targeting London are also targeting New York for exactly the same reasons," he said.