Albert Gonzalez: The Informant Behind the Card-Theft Cases

At 7 a.m. on May 7, 2008, Secret Service agents rushed into a suite at the National Hotel in Miami Beach and found Albert Gonzalez with two laptops, $22,000 in cash and a Croatian woman. Months later he led them to a barrel buried in his parents' backyard with more than a million dollars inside.

Gonzalez was the man behind the biggest card-theft spree ever prosecuted in the United States: TJX, OfficeMax, Dave & Buster's, 7-Eleven, Hannaford and the payment processor Heartland, roughly 180 million payment-card accounts in all.

Here's the twist. He did most of it while drawing a $75,000 salary from the US Secret Service as a paid informant, the same agency he'd just helped take down the biggest carding forum on the internet.

Albert Gonzalez at a Glance

• Born in Miami in 1981 to a Cuban father who'd crossed to Florida on a raft, Gonzalez bought his first PC at 12 and by 14 had hacked NASA, earning a visit from the FBI at his high school.
• Under the name soupnazi he ran with a crew of black hats, bought clothes with stolen card numbers and talked his way into a job at a New Jersey internet company he'd hacked.
• In July 2003 a New York detective caught him cashing out stolen cards at an ATM just before midnight, and the Secret Service turned him into an informant.
• He was the linchpin of Operation Firewall, which arrested 28 members of the Shadowcrew forum in a single night in October 2004.
• From 2005 his crew wardrove Miami's Route 1, hacked retailers' wireless networks and pulled more than 40 million card numbers from TJX and others, selling them through a Ukrainian fence.
• He called it Operation Get Rich or Die Tryin'. Then he moved to SQL injection and, with two Eastern European hackers, took 130 million numbers from Heartland and Hannaford.
• Arrested in May 2008 and indicted in Boston, New York and New Jersey, he pleaded guilty and in March 2010 drew two concurrent 20-year sentences, the longest ever for hacking at the time.
• Federal records show he was released on September 19, 2023.

The Life of Albert Gonzalez

Gonzalez's Early Years

Albert Gonzalez was born in Miami in 1981. His father, Alberto Sr., was a landscaper who as a young man left Cuba on a raft and was picked up by a Coast Guard cutter in the Florida straits.

Gonzalez bought his first PC with his own money at 12, and it promptly caught a virus. He peppered the technician who came to fix it with questions: how do I defend myself from this, and why would someone do it?

He got over the indignation quickly. By 14 he'd hacked into NASA, which brought FBI agents to his South Miami high school, and he formed a crew of curiosity-driven black hats. As soupnazi, he told ZDNet that defacing a site was about showing the admins "that we own them."

Soupnazi Meets the Secret Service

Gonzalez made his way north after hacking a New Jersey internet company and persuading it to hire him for its security team. Then, one night in July 2003, a plainclothes NYPD detective investigating car thefts followed a young man with long stringy hair and a nose ring into an ATM lobby in upper Manhattan.

The detective watched him pull out one debit card after another and withdraw hundreds of dollars from each. Gonzalez was cashing out a stack of blank cards programmed with stolen numbers, timed to just before midnight so the daily limit would reset and he could do it all again.

The Secret Service found millions of card accounts on the computer in his New Jersey apartment and a suspect who could patiently explain the whole underground. "I was 22 years old and scared," he later said. "When you have a Secret Service agent in your apartment telling you you'll go away for 20 years, you'll do anything."

He was a moderator on Shadowcrew, a bazaar for stolen card data and forged documents that one prosecutor called "an eBay, Monster.com and MySpace for cybercrime." For a year he helped the government build a trap, Operation Firewall, run out of a makeshift office in an Army repair garage in Jersey City.

On October 26, 2004, Gonzalez sat in the command center at Secret Service headquarters and corralled the targets into a chat session. At 9 p.m. agents began knocking down doors, and by midnight 28 people across eight states and six countries were under arrest.

Operation Get Rich or Die Tryin'

Gonzalez went home to Miami as a paid informant with a government salary. "The service's salary wasn't enough, and I needed the money," he told the New York Times Magazine from prison in 2010. "By then I'd already created the snowball and had to keep doing it."

His old EFnet friend Christopher Scott cruised the commercial stretches of Route 1 with a laptop and an antenna, hunting for retailers with weak wireless networks. BJ's Wholesale Club gave up about 400,000 card accounts, DSW a million.

In the summer of 2005 Scott parked outside two Marshalls stores and worked his way into the Framingham servers of the parent company, TJX. Court filings later tied an unindicted teenage associate called "J.J." to an earlier OfficeMax job; investigators suspected Jonathan James, who denied it and was never charged.

A sniffer program written by a friend, Stephen Watt, captured card numbers as they moved through the retailers' payment networks. By the time TJX discovered the breach, the count stood at 45.6 million cards, then the largest known in history, and the 2008 indictment listed nine retailers and more than 40 million numbers.

The numbers went to a Ukrainian fence, Maksym Yastremskiy, who sold them to buyers on three continents; prosecutors said his proceeds topped $11 million. Gonzalez named the scheme Operation Get Rich or Die Tryin', after the 50 Cent album, and only partly as a joke.

He bought a condo and a BMW 330i, lived in hotel suites on a whim and took trips to New York with Watt. "Whatever morality I should have been feeling was trumped by the thrill," he said. Chat logs showed the plan: make $15 million, buy a yacht, retire.

SQL Injection and Heartland

Wardriving bored him, so Gonzalez turned to SQL injection, feeding malicious commands through companies' websites into the databases behind them. With a friend named Patrick Toey living rent-free in his condo and doing much of the legwork, he went after Fortune 500 payment systems.

Hannaford Brothers gave up more than four million cards. And starting on December 26, 2007, he helped two Eastern European hackers he knew as Annex and Grig get inside Heartland Payment Systems, which processed transactions for about a quarter of a million businesses. Heartland and Hannaford together lost more than 130 million numbers.

The stolen data moved through servers leased in Latvia, Ukraine and the Netherlands, and the payment processor didn't even know it'd been owned until early January 2009.

The Barrel in the Backyard

The thread that unraveled everything ran through Turkey. Yastremskiy was arrested in a nightclub there in July 2007, and a Secret Service agent had already secretly copied his laptop in Dubai. The Ukrainian kept meticulous records, and his biggest supplier of stolen cards had once asked him to arrange a fake passport.

That request led the agents back to their own informant. The arrest at the National Hotel followed, and the barrel in the backyard, and on August 5, 2008, Attorney General Michael Mukasey held a press conference to call it "the single largest and most complex identity-theft case ever charged in this country."

The Secret Service said it'd discovered during the investigation that its own confidential informant was the ringleader. Gonzalez faced up to life in prison on the Boston indictment alone, and a New Jersey grand jury added the Heartland charges in August 2009.

Twenty Years

Gonzalez pleaded guilty in all three cases. On March 25, 2010, in Boston, he told Judge Patti Saris that he regretted exploiting "a certain government agency" that'd given him a second chance, and added: "I blame nobody but myself."

He asked for the minimum 15 years, citing Asperger's and computer addiction, which a psychiatrist for the prosecution found no evidence of. Prosecutor Stephen Heymann asked for 25: "What matters is that teenagers and young people not look up to him." Saris gave him 20, with a $25,000 fine, and the next day Judge Douglas Woodlock added 20 years and a day for Heartland, to run concurrently.

The government put the losses to companies, banks and insurers at close to $200 million. Toey got five years, Scott seven and Watt two, and a Turkish court gave Yastremskiy 30, according to the Justice Department.

Gonzalez Today

A 2011 motion to withdraw his plea, on the grounds that he'd been working for the Secret Service all along and could've claimed public authority, didn't free him. He served his time, and the Bureau of Prisons inmate locator records his release on September 19, 2023, at age 42.

"I've been asking myself, why did I do it?" he told James Verini for The Great Cyberheist, the definitive account of his story. Since his release he has, as far as the public record shows, stayed quiet.

Albert Gonzalez: The Informant Who Robbed the Store

The Secret Service thought it had a prize asset: a calm, respectable young man who could explain how carders thought and bring their forums down from the inside. It did, and he spent the same years building the biggest card-theft operation in American history under its nose.

That's the part that lasts. Every company on his victim list had firewalls and compliance paperwork; none had a defense against someone patient enough to sit in a parking lot with an antenna, or clever enough to ask a web form for the database behind it.

Gonzalez wanted $15 million and a yacht. He got 20 years, a famous nickname and a barrel in the backyard that his parents will never forget.