Hacker Pleads Guilty to Massive Data Thefts

A hacker responsible for many of the biggest identity thefts of the decade pleaded guilty earlier this month as part of a plea bargain that will send him to prison for up to 25 years.

Albert Gonzalez, 28, of Miami, admitted to hacking into the computer systems of retailers such as TJX, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, and Sports Authority.  Federal prosecutors say Gonzalez’s activities led to the theft of tens of millions of credit and debit card numbers.

Gonzalez entered guilty pleas in U.S. District Court in Boston to 19 counts of conspiracy, computer fraud, wire fraud, access device fraud, and aggravated identity theft.  He also pleaded guilty to a New York indictment charging one count of conspiracy to commit wire fraud.

Gonzalez faces 15 to 25 years in prison in the Massachusetts case and up to 20 years in the New York case.  The sentences would run concurrently.  Sentencing is scheduled for December 8.

Authorities said Gonzalez headed a group that targeted large retailers.  Gonzalez, who was known online as "soupnazi," is a self-taught computer genius.  In 2003, Gonzalez was arrested for hacking but was not charged because he became an informant, helping the Secret Service find other hackers.  But while he was ratting out his competition, authorities said he continued his own illegal activities.

Authorities said Gonzalez amassed a small fortune during that time.  Under the plea deals, Gonzalez must forfeit more than $2.7 million, as well as his condo, car, a Tiffany ring he gave to his girlfriend, and Rolex watches he gave to his father and friends.

The New York and Massachusetts indictments said Gonzalez and two foreign co-defendants used "wardriving," or cruising through different areas looking for accessible retailer wireless Internet signals.  Once they located a vulnerable network, they installed "sniffer programs" that captured credit and debit card numbers as they moved through a retailer's processing computers.  Then they tried to sell the data overseas.

Gonzalez still faces separate charges by federal prosecutors in New Jersey for allegedly targeting customers of convenience store chain 7-Eleven and supermarket chain Hannaford Brothers Co.

Why it matters:  In the past decade, the use of computer networks to transfer and store credit and debit card data has exploded.  Ferreting out and prosecuting identity thieves is critical to maintaining consumer trust in a system that has become an integral part of doing business in this country.