Hacker indicted over "largest ever case of identity theft"

 

Gallery

By Stuart Turton

Posted on 18 Aug 2009 at 08:28

A US hacker has been accused of the largest identify theft in history, after stealing the details of 130 million credit cards.

The sophisticated scam saw 28-year old Albert Gonzalez and two unnamed Russian conspirators hack into the payments systems of a number of large retail chains, including TJ Maxx and the 7-Eleven chain, to steal credit card information which they then tried to sell on the internet.

Alongside retail chains, investigators claim Gonzalez also targeted other large corporations on the Fortune 500 list, federal buildings and the US attorney's office in New Jersey.

Once a target was identified the men would visit the stores to see what kind of checkout and payments systems were being used. According to a 14-page report outlining the scheme, they then used an SQL injection attack to steal data which was stored on computers criss-crossing the US and Eastern Europe.

Other attacks involved the installation of backdoors and sniffers onto target computers to intercept and relay data as it was entered into the system.

Gonzalez, who once worked for the secret service, faces up to 20 years in jail, with an additional five years if found guilty of a secondary charge of conspiracy. The two charges also come with a maximum fine of $250,000. Gonzalez is already been held in a New York jail, where he is awaiting trial for stealing the credit identities of about 40 million people worldwide.

Experts have suggested the fallout from the trail may not be limited to the US: "Online crime is fully international. When credit card numbers get stolen from US websites, UK cardholders are among the victims. However the UK has primitive laws and consumer protection compared with the USA," notes Professor Ross Anderson of Cambridge University.