Gonzalez: The Al Capone Of Cyber Thieves?

Written by Evan Schuman and Fred J. Aun
August 19th, 2009

Albert Gonzalez, the Miami resident who was indicted last summer with stealing credit card data from TJX, BJ’s Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, Forever 21 and DSW can now add Heartland, Hannaford and 7-Eleven to the lengthy list of retailers that the federal government says he penetrated. In case you feel left out, there are two to three additional major retail chains that the feds have accused him of attacking, although those chains have yet to disclose that they were breached. (That’s likely to be divulged at trial and may never come to light if Gonzalez works out a plea bargain.)

And while he is accused—along with others—of having used POS networks as his own personal ATM machine, he’s also being accused of breaking into actual ATMs (and trying to use them as his own personal POS system?).

(Editor’s Note: There is a new story published that updates this one: J.C. Penney, Target Added To List Of Gonzalez Retail Victims. Gonzalez Agrees To Plead Guilty To Key Charges.)

The indictment—handed up Monday (Aug. 17) in Newark, NJ—offered a handful of new details about the breaches, but those disclosures brought more confusion. For example, 7-Eleven is a new name in the breach circle, and the indictment said that the $54 billion convenience store chain’s POS network files were directly—and successfully—attacked. In August 2007, “7-Eleven was the victim of a SQL injection attack that resulted in malware being placed on its network and the theft of an undetermined number of credit and debit card numbers and corresponding card data,” the indictment said.

But a statement that 7-Eleven issued on Tuesday (Aug. 18) tells a very different story. The 7-Eleven statement said that “affected transactions were limited to customers’ use of certain ATMs, owned and operated by a third party, located in 7-Eleven stores over a 12-day period from October 28, 2007, through November 8, 2007.”

That’s a very key difference, given that third-party ATM data—from machines that essentially leased space from various stores—would never be in the possession of 7-Eleven. Could it be that the stolen data was only used on such machines? Seems unlikely. When the TJX indictments against Gonzalez were handed up exactly a year ago (August 2008), one unidentified major retail chain victim also spoke of ATM assaults.

Another numerical mystery created by the indictment involves Heartland. Heartland has been adamant that it has no idea at all how many cards were impacted by the breach. Monday’s indictment gave the Heartland breach a very explicit number: 130 million. Said the indictment: “Beginning on or about December 26, 2007, Heartland was the victim of a SQL injection attack on its corporate computer network that resulted in malware being placed on its payment processing system and the theft of more than approximately 130 million credit and debit card numbers and corresponding card data.”

Heartland on Monday issued its own statement, which in journalistic circles would be called a non-statement statement as it didn’t actually say anything, except to congratulate the government for bringing the indictment. But Heartland Spokesperson Jason Maloni on Monday stood by the position that Heartland does not know the number of pieces of card data impacted. Asked how the government had figures that Heartland didn’t have, Maloni referred to the government’s number and said “We don’t see what this is based on.”

There’s plenty of wiggle room for Heartland here, as the comments certainly do not dispute the government’s figures.

The indictment lays out the rough means of attack that Gonzalez and three others used to access the retail databases. The others indicted on Monday with Gonzalez were identified solely as Hacker 1 and Hacker 2. (Wasn’t that taken from an updated Cat In The Hat book?) There is also a coconspirator referenced, identified only as P.T.

There’s an excellent chance that “PT” is actually Damon Patrick Toey, who plead guilty in December to working with Gonzalez on the TJX breach and strongly suggested to the sentencing judge that he was now working with the feds against Gonzalez. (Editor’s Note: Gonzalez’s attorney, Rene Palomino Jr., was quoted in a NYTimes story posted Wednesday (Aug. 19) confirming that PT was Patrick Toey and added that one of the unnamed Russian co-conspirators was Maksym Yastremski, who is currently serving a 30-year sentence in a Turkish prison. The Times story also quoted the attorney as saying that Gonzalez was about to plead guilty to federal cyber crime charges in New York and Massachusetts when New Jersey accelerated its indictment and, in effect, killed the plea negotiations.)


Comments are closed.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.