Hacker Charged in Massive Card Theft Case

Attempted theft of 130 million credit card numbers targeted 7-Eleven, Heartland, others

Published in CSP Daily News

WASHINGTON -- Federal prosecutors yesterday charged a Miami man with the largest case of credit and debit card data theft ever in the United States, reported the Associated Press. Authorities said Albert Gonzales, 28, has broken his own record for identity theft by hacking into more retail networks to steal data from 130 million accounts.

Prosecutors said Gonzales, who is also known online as "soupnazi," targeted customers of convenience store giant 7-Eleven Inc. and supermarket chain Hannaford Brothers Co. Inc. They also targeted Heartland Payment Systems, a New Jersey-based [image-nocss] card payment processor.

Gonzales, who is already in jail awaiting trial in a hacking case, was indicted in New Jersey, charged with conspiring with two other unnamed suspects to steal the private information. He is awaiting trial in New York for allegedly helping hack the computer network of the national restaurant chain Dave & Buster's. Trial in that case is due to begin next month.

He faces up to 20 years in prison if convicted of the new charges.

The Justice Department said the new case represents the largest alleged credit and debit card data breach ever charged in the United States, beginning in October 2006.

Gonzales allegedly devised a sophisticated attack to penetrate the computer networks, steal the card data and send that data to computer servers in California, Illinois, Latvia, the Netherlands and Ukraine.

The indictment also charges that Gonzales and his co-conspirators used sophisticated hacker techniques to cover their tracks and avoid detection.

Also last year, the Justice Department announced additional charges against Gonzales and others for hacking retail companies' computers for the theft of approximately 40 million credit cards. At the time, that was believed to be the biggest single case of hacking private computer networks to steal credit card data.