Investigation into the widespread credit-card fraud that targeted numerous people registered for this year’s Iron Horse Bicycle Classic continued this week. The Durango Police Department had received 78 reports as of Thursday afternoon.
“It’s very complicated, with lots of moving parts and lots of players,” said Ed Zink, chairman of the Iron Horse organizing committee. “We’re getting great cooperation, and everyone wants to solve this, including people whose cards were adversely affected.”
The first fraudulent charges apparently took place during the first week of February, and the fraudulent charges range from $200 to $1,400. The Durango Police Department requested assistance from the FBI last week.
“They have a lot more resources than we do,” said Lt. Ray Shupe with the police department. “We’re pretty confident the cards were hacked from outside the country. But we don’t know how long this will take, or where we are on the FBI’s priority list.”
The Iron Horse website, which does not store credit-card data, was not breached. The race uses third-party companies such as Mercury and Plug and Play for credit-card processing.
The situation is sort of like looking at a row of apartment houses, Zink said.
“We’re just one apartment,” he said, “and it does not appear that it started with us, but with one of the other apartments in the complex. This is not unique to us. We’re not the front door.”
Zink said the Iron Horse has taken down all of its websites until the situation is thoroughly understood. He was heartened by an email he received Thursday from a compliance officer with one of the agencies working on the investigation.
“She handles situations like this all day long,” he said. “And she said, ‘Don’t panic. You’ve done all the right things to contain this.’”
People who suspect their debit or credit card has been compromised should first contact their bank or credit-card company and then contact the Durango Police Department by calling dispatch at (970) 385-2900, said Capt. Dan Shry.