Man charged in hacking; 130 million credit card records hit

By
Byron Acohido, USA TODAY
August 17, 2009, 11:33 PM ET
2 min read

— -- Federal authorities in New Jersey on Monday charged accused TJX hacker Albert Gonzalez and two unnamed Russians with also cracking into the computer systems of Heartland Payment Systems, 7-Eleven, Hannaford Bros. and two unidentified companies.

Gonzalez, 28, of Miami, is now at the epicenter of the largest data breach criminal case in U.S. history. He was previously charged on May 2008 and August 2008 by federal authorities in eastern New York and Massachusetts, suspected of breaching data systems linked to more than 2,500 stores owned by the TJX tjx retail chain, parent of T.J. Maxx. TJX reported losing more than 94 million payment card transactions. Gonzalez pleaded not guilty and is awaiting trial.

He faces the Heartland charges beyond that. "This investigation marks the continued success of law enforcement in tracking down cutting-edge hacking schemes," Ralph Marra, acting U.S. Attorney of New Jersey said in a statement.

In a USA TODAY interview last fall, Rene Palomino, Gonzalez's attorney, described his client as a self-taught techie from a "hardworking, churchgoing family." Palomino said the TJX trial would "surprise a lot of people, including the government." He could not be reached Monday.

One major revelation in the New Jersey indictment: Gonzalez and his cohorts allegedly extracted 130 million records for card transactions from Heartland's databases beginning as early as Dec. 26, 2007. Heartland issued a public statement about the breach on Jan. 20, the day of President Obama's inauguration. Company President Robert Baldwin said then that Visa and MasterCard tipped Heartland off to the breach in fall 2008.

The New Jersey case could give a boost to lawsuits against Heartland by consumers, bank card companies and shareholders, says Scott Vernick, of Philadelphia business litigation firm Fox Rothschild. If hackers were extracting data from Heartland for nine months before being discovered, attorneys in those lawsuits "will want to know whether Heartland knew something sooner than it says it did and whether its systems were appropriately configured," Vernick says.

Heartland declined to comment on Monday, beyond a brief statement issued by CEO Robert Carr promising to support the case against Gonzalez.