Albert Gonzalez

Early Life and Introduction to Hacking

Albert Gonzalez was born on October 23, 1981, and grew up in Miami, Florida, where he attended South Miami Senior High School. He reportedly received his first computer around age 12 and displayed an early aptitude for computers and networking. As a teenager he was known to associates by online handles rather than his real name, and by the early 2000s he had become involved in online forums dedicated to trading stolen financial data.

ShadowCrew and First Arrest

In the early 2000s, Gonzalez became a member of the inner circle of ShadowCrew, an online forum used by cybercriminals to buy, sell, and trade stolen credit card and bank account numbers, counterfeit documents, and hacking tools. In 2003, using the screen name "CumbaJohny," he was arrested in New York for possessing and using stolen bank card numbers obtained through ATM skimming. Facing prosecution, Gonzalez agreed to cooperate with the U.S. Secret Service.

Secret Service Informant

Rather than face charges, Gonzalez became a confidential informant for the Secret Service, helping investigators monitor ShadowCrew members. His cooperation contributed to "Operation Firewall," a 2004 law enforcement action that resulted in the arrest of more than a dozen ShadowCrew members and effectively shut the forum down. Gonzalez continued working with the Secret Service afterward, reportedly relocating to Miami where he was paid as an informant while investigators believed he had left cybercrime behind.

Renewed Hacking Operations

Despite his informant status, Gonzalez continued to organize and participate in large-scale hacking operations between roughly 2005 and 2008. Working with co-conspirators, he used techniques including SQL injection and wardriving to identify vulnerable corporate wireless networks and web applications. His group breached the networks of major retailers including TJX Companies (parent of T.J. Maxx and Marshalls), BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, and Dave & Buster's, stealing tens of millions of payment card numbers that were later resold through underground carding networks.

The Heartland Payment Systems Breach

Beginning in late 2007, Gonzalez and his associates targeted Heartland Payment Systems, a major U.S. payment card processor, along with 7-Eleven and Hannaford Brothers. Using SQL injection to penetrate corporate networks and install data-sniffing malware, the group intercepted card data as it was processed, ultimately compromising an estimated 130 million or more card numbers at Heartland alone—making it, combined with the TJX breach, part of what prosecutors described as the largest identity theft and credit card fraud scheme charged in U.S. history at the time, involving more than 170 million card and ATM numbers overall.

Arrest and Prosecution

Gonzalez was arrested on May 7, 2008, at the National Hotel in Miami Beach, Florida, after investigators traced the Dave & Buster's intrusion back to him. He faced three separate federal indictments: one in New York in May 2008 related to the Dave & Buster's breach, one in Massachusetts in May 2008 related to the TJX breach, and one in New Jersey in August 2009 related to the Heartland, 7-Eleven, and Hannaford breaches. Prosecutors detailed that Gonzalez had used aliases including "segvec," "soupnazi," and "j4guar17," and had hidden proceeds from card fraud, including large sums of cash buried in his backyard.

Sentencing and Legacy

On March 25, 2010, a federal judge in Massachusetts sentenced Gonzalez to 20 years in prison for the TJX-related conspiracy and fraud charges. The following day, a federal judge in New Jersey sentenced him to 20 years and one day for the Heartland-related conspiracy, to run concurrently with the first sentence, resulting in a total 20-year term—among the longest sentences ever handed down in the U.S. for a hacking-related case at that time. The case is widely cited in cybersecurity literature and law enforcement training as a landmark example of large-scale payment card fraud, the risks of relying on cooperating informants who continue offending, and the vulnerabilities that SQL injection attacks pose to corporate and financial networks.

Timeline

• 1981-10-23Albert Gonzalez is born in Miami, Florida.
• 2003Arrested in New York for possessing stolen ATM/bank card numbers; agrees to cooperate with the U.S. Secret Service as an informant, using the handle "CumbaJohny" on ShadowCrew.
• 2004-10Secret Service's "Operation Firewall," aided by Gonzalez's cooperation, leads to the arrest of more than a dozen ShadowCrew members.
• 2005Gonzalez and associates begin a multi-year hacking campaign against major U.S. retailers using SQL injection and wardriving techniques.
• 2007TJX Companies breach concludes after roughly 18 months, with an estimated 45.6 million credit and debit card numbers stolen.
• 2007-12Gonzalez's group begins targeting Heartland Payment Systems, 7-Eleven, and Hannaford Brothers networks.
• 2008-05-07Gonzalez is arrested at the National Hotel in Miami Beach, Florida.
• 2008-05Federal indictments filed against Gonzalez in New York (Dave & Buster's case) and Massachusetts (TJX case).
• 2009-08Third federal indictment filed in New Jersey covering the Heartland Payment Systems, 7-Eleven, and Hannaford breaches.
• 2010-03-25Sentenced to 20 years in federal prison in the Massachusetts (TJX) case.
• 2010-03-26Sentenced to 20 years and one day in the New Jersey (Heartland) case, to run concurrently with the prior sentence.