A cyber gang from London who plundered £1.25m from British banks are facing jail after being found guilty of fraud.
The organised crime group was led by "Acid House King" Tony Colston-Haytor, who threw the notorious Acid House raves in the Home Counties which sparked controversy in 1989.
The gang used trojan horse malware to hijack computers at branches of Barclays and Santander and siphon-off cash as well as steal credit and bank card details from around one million intercepted letters and use them to splash out on Rolex watches and designer jewellery worth more than £1m, police said.
The son of a university lecturer and solicitor, Colston-Haytor had earlier pleaded guilty to masterminding the fraud while 10 others also admitted their part in the scam. At Southwark Crown Court, two more men, Lanre Mullins-Abudu, 25, and Steven Hannah, 52, were found guilty of their roles in the audacious fraud.
Opening the case, prosecutor Simon Farrell QC said: "This case concerns a sophisticated and organised attack on the banking system in this country which took place in 2012 and 2013. It involved the use of computer technology to steal from banks and the improper use of thousands of credit cards, which had been stolen."
Jurors had heard that the gang used a device known as a keyboard video mouse (KVM) switch to access and control Barclays and Santander bank accounts remotely on three occasions.
Darius Bolder, 34, walked into a branch of Barclays in Swiss Cottage, north London, on 4 April last year, allowing the group to access the bank's IT system. The gang used the trojan-horse style KVM device to make 128 transfers worth £1,252,490 to a network of mule accounts set up to launder the stolen cash.
Their victims included London Metropolitan University and the University of Portsmouth.
Just three months later the gang struck again when Dean Outram, 32, went into the Lewisham branch of Barclays on 17 July and illicitly gained access to its computers, stealing £90,000.
And two months later Outram managed to gain access to Santander's IT system by fitting a KVM switch into a bank computer at one of its branches in Surrey Quays, south-east London.
Meanwhile, Lanre Mullins-Abudu, 25, and Asad Ali Qureshi, 26, tried to hack into Santander's banking system in order to steal what police warned would have been "substantial funds", but police swooped on an address in Kingsley Avenue in Hounslow, west London, where Mullins-Abudu, Qureshi and eight others were arrested.
Officers discovered computers that were logged into the KVM and Santander bank accounts – but the gang had not yet managed to steal any money. They arrested Outram nearby after he left the bank.
As well as the cyber attacks, the gang used around 500 stolen or intercepted bank and credit cards to go on expensive shopping sprees.
They got the details by using a sophisticated device which "spoofed" genuine bank numbers, phoned customers and tricked them into handing over their personal details and PIN numbers.
They used their ill-gotten gains to buy Rolex watches worth up to £30,000 each, expensive jewellery and state-of-the-art iPads and Apple Mac computers, police said.
The Association of Chief Police Officers' national cyber crime lead, Derbyshire Deputy Chief Constable Peter Goodman, said: "We know that criminals are continually looking to exploit new innovation to commit these offences against our financial institutions, businesses, public sector organisations and even individual members of the public, but we are also keeping pace with advances in technology-enabled crime."
Barclays has recovered around £600,000 of the stolen money.
Mullins-Abudu, of Weimar Street, Putney, south-west London, was found guilty of conspiracy to commit fraud, two counts of conspiracy to steal, possession of articles for use in fraud, and concealing criminal property.
Hannah, of Bell Street, Marylebone, west London, was found guilty of conspiracy to commit fraud.
Duane Jean-Jacques, 25, of Belsize Road, South Hampstead, was cleared of conspiracy to steal and concealing criminal property.
They will be sentenced at a later date.