A US government informant who helped jail fellow hackers five years ago, is the kingpin of the biggest data breaches in US history, according to enforcement officials.
Albert Gonzalez, 28, of Miami, was indicted this week for the third time in connection with the separate major data breaches. Gonzalez and two Russian citizens were indicted by a grand jury in New Jersey on charges of running an international scheme to steal more than 130 million credit and debit card numbers, along with personally identifying information from five companies, including Heartland Payment Systems, 7-Eleven and Hannaford Brothers.
Federal investigators and prosecutors are calling yesterday's third indictment of Gonzalez a coup for the government.
The latest indictment is far from the Miami man's first brush with the law.
Gonzalez, who is being held in detention, was indicted on May 12, 2008, and on August 5, 2008, on charges related to separate data breaches at TJX Companies, Dave & Busters, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, Forever 21 and DSW.
Before the Heartland hack was disclosed, the TJX breach had been considered the largest ever, with 45.6 million credit and debit card numbers stolen.
Gonzalez had became an informant for the US Secret Service after his 2003 arrest in New Jersey on on charges of ATM and debit card fraud, according to an official at the US Department of Justice, who asked not to be named.
In 2004, Gonzalez provided information that helped the US Attorney's Office bust up what at the time was one of the largest online centres for stolen identity and credit card information. The online underground marketplace, dubbed the Shadowcrew group was charged with trafficking more than 1.5 million stolen credit and ATM card numbers.
Twenty-eight people were arrested and 27 pled guilty in connection with that incident. One man fled and became a fugitive.
Scott Christie, a former US prosecutor who now leads the information technology group at law firm McCarter & English LLP, said it is clear that Gonzalez had been a leader of the Shadowcrew ring. Christie, who worked as a prosecutor on the Shadowcrew case, would not comment on any work that Gonzalez may have done for the government or why he was not arrested for his alleged role in the ring.
The DOJ official did confirm that Gonzalez acted as an informant in the case. However, according to this week's indictment, Gonzalez was allegedly continuing to work as a criminal hacker at the same time he was cooperating with the government.
The fact that federal authorities were unable to prevent Gonzales from carrying out the attacks on Heartland, Hannaford and other retailers despite his previous record speaks both to his tenacity and his apparently extensive ring of accomplices, said Avivah Litan, an analyst at Gartner Inc.
"Gonzalez appears unstoppable, and likely has many cronies lined up to help him in his endeavors," she said.
Assistant US Attorney Erez Liebermann, who is prosecuting the case against Gonzalez in New Jersey, said that in addition to his alleged hacking skills, Gonzalez is a great organiser.
He noted that Gonzalez is alleged to have worked with a different crew in each of the three incidents he's been indicted for. He is alleged to have worked with one crew to hack into Heartland and Hannaford systems, another in the TJX attack and yet another to illegally access data from Dave & Busters and other New York-based businesses.
"He was a person capable of hacking and then bringing people together to complete the task at hand," said Liebermann.
Christie said that Gonzalez clearly had "his hand in many pies."
"He seems to be the Bernie Madoff of online data theft," said Christie. "If it's all true, he would be one of the most prolific of the online data thieves that we know about. [The indictments] certainly are a big deal for consumers who charge purchases on their debit and credit cards every day. It's definitely good news for people who want to keep their good credit."
Richard Wang, manager of SophosLabs U.S., said that online data theft, especially in cases as massive as Heartland, Hannaford and TJX, take great coordination and that stopping them requires law enforcement to shut down the criminal organisations coordinating the hacks.