Stolen: 130 million credit & debit card details!

Stuart Corner
Tuesday, 18 August 2009 04:00

IT Industry - Strategy

A 28 year old US hacker has been charged with stealing 130 million credit and debit card details from major US retail and financial organisations.

The US Department of Justice has issued a press release announcing the indictment of Albert Gonzalez of Miami, Florida "for conspiring to hack into computer networks supporting major American retail and financial organisations, and stealing data relating to more than 130 million credit and debit cards."

It is the largest credit and debit card data breach ever charged in the United States and follows charges  against Gonzalez over separate allegations that he stole data on 40 million cards from other organisations. The announcement also alleges that the stolen data was sent to computer servers operated by Gonzalez and his co-conspirators in California, Illinois, Latvia, the Netherlands and Ukraine, but makes no mention of fraudulent use of any of these details.

It says that Gonzalez, AKA 'segvec,' 'soupnazi' and "j4guar17,' has been charged, along with two unnamed co-conspirators, with using a sophisticated hacking technique called an 'SQL injection attack,' which sought to exploit computer networks by finding a way around the network's firewall to steal credit and debit card information.

Among the corporate victims named in the indictment are Heartland Payment Systems, a New Jersey-based card payment processor; 7-Eleven, a Texas-based nationwide convenience store chain; and Hannaford Brothers Co, a Maine-based supermarket chain.

From October 2006, Gonzalez and his co-conspirators are alleged to have researched the credit and debit card systems used by their victims; devised a sophisticated attack to penetrate their networks and steal credit and debit card data; and then sent that data to their various servers. The indictment also alleges Gonzalez and his co-conspirators used sophisticated hacker techniques to cover their tracks and to avoid detection by anti-virus software used by their victims.

If convicted, Gonzalez faces up to 20 years in prison on the wire fraud conspiracy charge and an additional five years in prison on the conspiracy charge, as well as a fine of $250,000 for each charge. He is currently in federal custody.

Separately, in May 2008, the US Attorney's Office for the Eastern District of New York charged Gonzalez for, allegedly, hacking into a computer network run by a national restaurant chain. Trial on those charges is scheduled to begin in Long Island in September 2009.

In August of 2008, the Justice Department announced an additional series of indictments against Gonzalez and others for a number of retail hacks affecting eight major retailers and involving the theft of data related to 40 million credit cards. Those charges were filed in the District of Massachusetts. Gonzalez is scheduled for trial on those charges in 2010.

The Justice Department says that the new charges announced today relate to a different pattern of hacking activity that targeted different corporate victims and involved different co-conspirators.