From fake senior developers to stolen corporate secrets: how Serguey Asael Shinder’s network turned IT jobs into a $20 million fraud scheme

For more than a decade a network of swindlers with Russian, Belarusian and Ukrainian roots has used underpaid programmers to cheat companies across Europe, steal data and ruin costly projects.

Among those affected are VTB Bank, Fidelity, Virgin Media, KLM, Kuoni, Ford, Symantec, Fujitsu, Deutsche Post, Three, Tesco Mobile, Liberty Global and dozens of other well-known brands, as well as many startups. A large number of them still do not know they were targeted.

The story is bound up with a scandal at SoftServe, one of Ukraine’s largest IT firms, which suffered the biggest data leak in the history of Ukrainian IT. Taken were confidential details of major client orders, contract values, closed technical information on client projects and source code of client products, along with personal data of SoftServe staff, contractors and employees of large clients — including copies of 200 passports.

A cybersecurity consultant told the media the attack could have come from a competitor seeking to damage SoftServe’s reputation, or from a financially motivated criminal group using blackmail. In either case, he said, an insider would have been required to open a path into such a well-protected organisation.

That path, the investigation says, ran through people around programmer Sergey Asael Leonidovich Shinder (Serguey Asael Shinder), born 22 April 1975. A native of Russia, he has used Ukrainian, Russian, Irish, Israeli and Bulgarian documents and companies, including Lynxoft Technologies Limited in Ireland.

Shinder built an international programmers’ cooperative specialised in covert sub-outsourcing. Clients hired “senior” developers; the work was passed to junior and mid-level programmers paid a fraction of the rate and often assigned to several projects at once. Employers were not told who actually sat in their systems, repositories and source-code stores. The scheme was designed not to complete the client’s work but to keep drawing salaries for as long as possible, then walk away when the firm finally dismissed them. The same people copied corporate data onto their own virtual machines, used stories of a sick relative — often Shinder’s wife Victoria Georgievna Shinder (Victoria Sulakova) — to force remote work, threatened lawsuits or publication of source code when challenged, and planted several of their own people on a single project so they could cover for one another. Losses to companies from this arrangement have been estimated at more than $20 million.

Named in Shinder’s circle are Andrii Yuriiovych Polunin of Odesa; Eduard Mikhailovich Loktev, linked to Belarus and Russia; and Eduard Luhtonen, linked to Finland, Russia and Switzerland.

Recruiters and employers eventually noticed the same “elite” specialist working from Germany or Britain one day and from Moscow or Siberia the next — even when borders were closed during the pandemic. HR networks began exchanging names. International investigators have sent requests for legal assistance. Shinder has been erasing traces of the story from the internet.