Gonzalez, who is already in jail awaiting trial in a hacking case, was indicted Monday in New Jersey and charged with conspiring with two other unnamed suspects to steal the private information. Prosecutors say the goal was to sell the stolen data to others.
Gonzales goes by the online name "soupnazi."
The Justice Department said the new case represents the largest alleged credit and debit card data breach ever charged in the United States, based on a scheme that began in October 2006.
Gonzalez allegedly devised a sophisticated attack to penetrate the computer networks, steal the card data, and send that data to computer servers in California, Illinois, Latvia, the Netherlands and Ukraine.
Today's indictment is here. I'll bet it has some relationshop to the case of individuals from the Former Soviet Union busted in Denver last week I wrote about here, where the FBI raided a medical marijuana dispensary located in the same building as businesses for which it had search warrants in the bank fraud/credit card scamming case. The New Jersey indictment says:
It was further part of the conspiracy that those who purchased batches of the Stolen Data would further distribute the Stolen Data throughout the United States and elsewhere, where it would be used to make unauthorized purchases at retail locations, to make unauthorized withdrawals from banks and financial institutions, and to further identity theft schemes.
The Colorado case involves alleged credit card fraud of $80 million through use of 700 straw buyers.
This is all related to a scam under investigation since October, 2007 by people from the Former Soviet Union who came here on visas. The complaint alleges a criminal enterprise is behind their actions. It alleges they formed phony businesses, got credit cards and loans and didn't pay them back. It was a "bust out scheme."
Back to Gonzalez, how did he allegedly pull it off?
According to the indictment, Gonazalez and his two Russian coconspirators would hack into corporate computer networks and secretly place "malware," or malicious software, that would allow them backdoor access to the networks later to steal data.
As to his other cases: The DOJ press release today says:
Gonzalez is currently in federal custody. In May 2008, the U.S. Attorney’s Office for the Eastern District of New York charged Gonzalez for his alleged role in the hacking of a computer network run by a national restaurant chain. Trial on those charges is scheduled to begin in Long Island, N.Y., in September 2009.
In August of 2008, the Justice Department announced an additional series of indictments against Gonzalez and others for a number of retail hacks affecting eight major retailers and involving the theft of data related to 40 million credit cards. Those charges were filed in the District of Massachusetts. Gonzalez is scheduled for trial on those charges in 2010.
The charges announced today relate to a different pattern of hacking activity that targeted different corporate victims and involved different co-conspirators.
Here's his 2008 indictment in Mass.
I wonder how many people went to jail because of his testimony as an informant.