A US government informant who helped jail fellow hackers five years ago, is the kingpin of the biggest data breaches in US history, according to enforcement officials.
Albert Gonzalez, 28, of Miami, Fla., was indicted this week for the third time in connection with the separate major data breaches. Gonzalez and two Russian citizens Monday were indicted by a grand jury in New Jersey on charges of running an international scheme to steal more than 130 million credit and debit card numbers, along with personally identifying information from five companies, including Heartland Payment Systems Inc., 7-Eleven Inc. and Hannaford Brothers Co.
Federal investigators and prosecutors are calling yesterday's third indictment of Gonzalez a coup for the government.
The latest indictment is far from the Miami man's first brush with the law.
Gonzalez, who is being held in detention, was indicted on May 12, 2008, and on August 5, 2008, on charges related to separate data breaches at TJX Companies, Dave & Busters, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, Forever 21 and DSW.
Before the Heartland hack was disclosed, the TJX breach had been considered the largest ever, with 45.6 million credit and debit card numbers stolen.
Gonzalez had became an informant for the US Secret Service after his 2003 arrest in New Jersey on on charges of ATM and debit card fraud, according to an official at the US Department of Justice, who asked not to be named.
In 2004, Gonzalez provided information that helped the US Attorney's Office bust up what at the time was one of the largest online centres for stolen identity and credit card information. The online underground marketplace, dubbed the Shadowcrew group was charged with trafficking more than 1.5 million stolen credit and ATM card numbers.
Twenty-eight people were arrested and 27 pled guilty in connection with that incident. One man fled and became a fugitive.
Scott Christie, a former US prosecutor who now leads the information technology group at law firm McCarter & English LLP, said it is clear that Gonzalez had been a leader of the Shadowcrew ring. Christie, who worked as a prosecutor on the Shadowcrew case, would not comment on any work that Gonzalez may have done for the government or why he was not arrested for his alleged role in the ring.
The DOJ official did confirm that Gonzalez acted as an informant in the case. However, according to this week's indictment, Gonzalez was allegedly continuing to work as a criminal hacker at the same time he was cooperating with the government.
The fact that federal authorities were unable to prevent Gonzales from carrying out the attacks on Heartland, Hannaford and other retailers despite his previous record speaks both to his tenacity and his apparently extensive ring of accomplices, said Avivah Litan, an analyst at Gartner Inc.
"Gonzalez appears unstoppable, and likely has many cronies lined up to help him in his endeavors," she said.
Find your next job with computerworld UK jobs