A government informant who helped put away nearly 30 fellow hackers five years ago, is considered by US law enforcement officials to be the kingpin of the biggest data breaches in US history.
Albert Gonzalez, 28, of Miami, Florida, was indicted yesterday for the third time in connection with the separate major data breaches. Gonzalez and two Russian citizens were indicted on Monday by a grand jury in New Jersey on charges of running an international scheme to steal more than 130 million credit and debit card numbers, along with personally identifying information from five companies, including Heartland Payment Systems, 7-Eleven and Hannaford Brothers.
Federal investigators and prosecutors are calling yesterday's third indictment of Gonzalez a coup for the government.
The latest indictment is far from the Miami man's first brush with the law.
Gonzalez, who is being held in a detention center in Brooklyn, New York, was indicted in the Eastern District of New York on May 12, 2008, and the District of Massachusetts on August 5, 2008, on charges related to separate data breaches at TJX Companies, Dave & Busters, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, Forever 21 and DSW. Before the Heartland hack was disclosed, the TJX breach had been considered the largest ever, with 45.6 million credit and debit card numbers stolen.
Gonzalez had became an informant for the US Secret Service after his 2003 arrest in New Jersey on on charges of ATM and debit card fraud, according to an official at the US Department of Justice, who asked not to be named.
In 2004, Gonzalez provided information that helped the US Attorney's Office in Newark, NJ bust up what at the time was one of the largest online centers for stolen identity and credit card information. The online underground marketplace, dubbed the Shadowcrew group was charged with trafficking more than 1.5 million stolen credit and ATM card numbers.
Twenty-eight people were arrested and 27 pled guilty in connection with that incident. One man fled and became a fugitive.
Scott Christie, a former federal prosecutor who now leads the information technology group at law firm McCarter & English LLP, said it is clear that Gonzalez had been a leader of the Shadowcrew ring. Christie, who worked as a prosecutor on the Shadowcrew case, would not comment on any work that Gonzalez may have done for the government or why he was not arrested for his alleged role in the ring.
The DOJ official did confirm that Gonzalez acted as an informant in the case. However, according to this week's indictment, Gonzalez was allegedly continuing to work as a criminal hacker at the same time he was cooperating with the government.
The fact that federal authorities were unable to prevent Gonzales from carrying out the attacks on Heartland, Hannaford and other retailers despite his previous record speaks both to his tenacity and his apparently extensive ring of accomplices, said Avivah Litan, an analyst at Gartner.
"Gonzalez appears unstoppable, and likely has many cronies lined up to help him in his endeavours," she said.
Assistant US Attorney Erez Liebermann, who is prosecuting the case against Gonzalez in New Jersey, said that in addition to his alleged hacking skills, Gonzalez is a great organiser. He noted that Gonzalez is alleged to have worked with a different crew in each of the three incidents he's been indicted for. He is alleged to have worked with one crew to hack into Heartland and Hannaford systems, another in the TJX attack and yet another to illegally access data from Dave & Busters and other New York-based businesses.
"He was a person capable of hacking and then bringing people together to complete the task at hand," said Liebermann.
Christie said that Gonzalez clearly had "his hand in many pies."
"He seems to be the Bernie Madoff of online data theft," said Christie. "If it's all true, he would be one of the most prolific of the online data thieves that we know about. [The indictments] certainly are a big deal for consumers who charge purchases on their debit and credit cards every day. It's definitely good news for people who want to keep their good credit."
Richard Wang, manager of SophosLabs U.S., said that online data theft, especially in cases as massive as Heartland, Hannaford and TJX, take great coordination and that stopping them requires law enforcement to shut down the criminal organizations coordinating hacks.