Virginia Beach Police (VBPD) is investigating an incident last week where suspects reportedly hacked into a CITGO gas station pump and stole more than $13,600 worth of gas. Two men have been charged in connection with the crime.
Officers said the individuals used a remote device to hack the pump and steal over 400 gallons of fuel in a span of just a few hours. The devices they used allowed them to bypass the computer and not register the sale.
Scott Gibson, a cyber security expert and professor at ECPI University, told Richmond’s CBS affiliate that the hackers likely accessed the gas station’s internal web system using a laptop.
Hackers are able to access the system by exploiting holes in a business’s wifi or through a business employee opening a malicious email.
“Ask questions before you click,” Gibson said in an interview with the TV station. “Now they can get in there and set it up so at this day and this time, [they can] dispense the gas.”
While patrolling the area, officers on the midnight shift noticed an abnormal amount of people gathering around the gas station after hours.
Once officers started investigating the incident, they found a social media post that said, “Gas fill up tonight at 11 p.m. Don’t be late and spread the word. All gas, half off DM me for addy. Gas fill ups.”
This post caught the attention of the VBPD, causing them to approach, detain and interview the individuals at CITGO.
VBPD’s investigation revealed that individuals were receiving payment through CashApp and used their device to turn on the pumps.
The gas station owner confirmed to police that he had noticed missing fuel the week before, but didn’t understand how. He said that he lost $13,600 in gas in a single week, along with 600 gallons of gas that were stolen later that evening.
The VBPD have identified the suspects as 24-year-old Rashane Griffith and 21-year-old Devon Drumgoole, both of Norfolk, Virginia. The men were charged with Grand Larceny, Conspiracy and Possession of Burglary Tools. Police also said that more charges could be filed.
However, Professor Gibson said that this type of hacking is highly sophisticated and suggests more people may be behind the crime.
“Somebody had to create the malware, somebody had to have an understanding of the software,” Gibson explained. “It’s highly sophisticated, but the people actually executing it may not be sophisticated.”