Two men arrested for allegedly hacking JFK taxi system

Two US citizens have been arrested and accused of conspiring with Russian nationals to hack the taxi dispatch system at John F. Kennedy International Airport (JFK), charging cab drivers a $10 fee to access the front of the queue between September 2019 and September 2021.

Daniel Abayev and Peter Leyman (both 48 and from Queens, New York) first successfully hacked the dispatch system in 2019 with the help of unnamed Russian nationals, according to a DOJ indictment filed in the Southern District of New York. Leyman and Abayev accessed the system to move specific taxis to the front of the line, says the DOJ, charging drivers a $10 fee for the privilege. Members of the hacking scheme also offered to waive the $10 fee in exchange for recruiting more taxi drivers.

The computer-controlled JFK taxi dispatch system manages how cabs are dispatched between the airport’s holding lot and terminal. The system was introduced to create a fair working environment, but wait times of several hours can impact a taxi driver’s daily earnings.

The hackers utilized group chats to communicate with taxi drivers and advise them how to avoid detection by law enforcement. According to the indictment, Leyman and Abayev approved as many as 1,000 trips a day and transferred at least $100,000 to the hackers in Russia as “payment for software development.”

Prosecutors allege that the pair explored several ways to hack the system, including bribing someone to infect its computers with malware via a flash drive, stealing connected computer tablets, and accessing the dispatch system without authorization via Wi-Fi. The indictment claims that members of the hacking scheme also sent messages to each other in which they explicitly discussed their intention to hack the dispatch system. “I know that the Pentagon is being hacked[.]. So, can’t we hack the taxi industry[?]” Abayev messaged a Russian conspirator in November 2019.

“For years, the defendants’ hacking kept honest cab drivers from being able to pick up fares at JFK in the order in which they arrived,” said U.S. Attorney Damian Williams in a statement. “Now, thanks to this Office’s teamwork with the Port Authority, these defendants are facing serious criminal charges for their alleged cybercrimes.”

Both men have been charged with two counts of conspiracy to commit computer intrusion, which carries a maximum 10-year sentence in prison if proven guilty.