Update: Eleven indicted in massive ID theft scheme
Indictment alleges that TJX, DSW, other mega-breaches have connections
IDG News Service - Eleven people have been charged or indicted in a massive identity theft and computer fraud scheme involving some of the largest data breaches in recent U.S. history, the Department of Justice announced Tuesday.
The participants in the scheme targeted nine U.S. retailers, including BJ's Wholesale Club, TJX and DSW Shoe Warehouse, DoJ officials said. Those three retailers all announced large data breaches between 2004 and 2007. OfficeMax, Barnes & Noble, Boston Market, Sports Authority and Forever 21 also were targeted.
The ID theft ring stole more than 40 million credit and debit card numbers, said Michael Sullivan, U.S. attorney for the District of Massachusetts. The criminals installed sophisticated "sniffer" programs on the retailers' networks, allowing them to collect credit card and password information, he said during a press conference.
This case is believed to be the largest hacking and ID theft case the DoJ has ever prosecuted, said U.S. Attorney General Michael Mukasey.
"This case highlights our increasing vulnerability to the theft of personal information," he added during a press conference. "Computer networks and the Internet are an indispensable part of the world economy. But even as they provide extraordinary opportunities for legitimate commerce and communication, they also provide extraordinary opportunities for criminals. Where criminals are able to breach computer security systems, as alleged here, they have enormous ability to cause harm."
On Tuesday, a federal grand jury in U.S. District Court for the District of Massachusetts indicted Albert "Segvec" Gonzalez of Miami on charges of computer fraud, wire fraud, access device fraud, aggravated identity theft and conspiracy for his role in the scheme.
The DOJ also announced charges Tuesday against Christopher Scott and Damon Patrick Toey, both of Miami.
Other defendants face numerous charges in California and New York, the DOJ said.
Three of the defendants are U.S. citizens, one is from Estonia, three are from Ukraine, two are from China and one is from Belarus, the DOJ said. One individual is only known by an online alias, and his place of origin is unknown.
After collecting the data, the defendants allegedly concealed it in encrypted servers they controlled in Eastern Europe and the U.S., the DOJ said. They allegedly sold some of the credit and debit card numbers on the Internet to other criminals. The stolen numbers were cashed out by encoding card numbers on the magnetic strips of blank cards.
The defendants then used these cards to withdraw tens of thousands of dollars at a time from cash machines, the DOJ said. Gonzalez and others were allegedly able to conceal and launder their fraud proceeds by using anonymous Internet-based currencies and by channeling funds through bank accounts in Eastern Europe, the DOJ said.



- Excel 2010 Cheat Sheet
- Register for this Computerworld Insider Cheat Sheet and gain access to hundreds of premium content articles, guides, product reviews and more.
- Streamline Compliance and Increase ROI
- Streamline, simplify, and automate compliance related activities; especially those that impact multiple business units. This white paper from NetIQ, outlines solutions that will...
- Protecting Point of Sale Systems from Targeted Attack
- If you are responsible for protecting retail systems, download this case study to learn how this retailer eliminated the threat of malware on...
- From the Frontline - Preventing APT
- Is your company's network secure? Are your endpoints and servers secured? Before you answer, read this case study on a US Military Command...
- Stop Hackers Before They Attack
- Hacktivism, Identify Theft, Financial Gain, Cyber War - regardless of motivation, stopping today's hackers requires a new proactive approach to protecting endpoints. Learn...
- The four rules of complete web protection
- As an IT manager you've always known the web is a dangerous place. But with infections growing and the demands on your time... All Cybercrime and Hacking White Papers
- WikiLeaks: How am I Affected?
- The latest WikiLeaks episode has raised questions about how organizations and governments protect their sensitive information. While this incident was isolated, it has...
- Optimizing Networks for the Cloud
- Join guest speaker, Rohit Mehra, IDC Director of Enterprise Communications Infrastructure, to explore current trends, discuss best practices for optimizing Data Center and...
- Apps QuickStart Series Part 2: Designing and Deploying SQL Server on VMware vSphere
- Download this webcast to learn about the design considerations for virtualizing SQL workloads, performance and scalability information and high-availability options, as well as...
- Apps QuickStart Series Part 1: Designing and Deploying Exchange 2010 on VMware vSphere
- Download this webcast to learn the virtual hardware design considerations for Exchange 2010, deployment using the building block approach, options for high-availability and...
- Customer Spotlight: How IPC The Hospitalist Company Implemented Oracle on VMware
- Have you been looking to hear about customer's experiences with the new VMware vCenter Site Recovery Manager product? View this webcast to learn... All Cybercrime and Hacking Webcasts