Albert Gonzalez

Albert Gonzalez, known online as CumbaJohnny, was the mastermind behind shadowcrew.com, a black market website for hackers to sell stolen credit card numbers, Social Security Numbers, passports, and just about any other type of information imaginable. But when he got arrested for credit card fraud in 2003, he switched sides and became the key informant for the government in “Operation: Firewall,” a massive program designed to take down hackers. Thanks to Gonzalez’s assistance, 28 hackers, scattered across eight states and six foreign countries, were indicted on charges of selling around 1.7 million credit card numbers. For his assistance, Gonzalez was immune from all charges and was offered a job at the Secret Service.

With the Secret Service looking over his shoulder, Gonzalez developed a new online persona known as “soupnazi” to help snare hackers for the U.S. Government. But once he left the office for the day, soupnazi partnered with hacker Maksym Yastremski (aka Maksik), a Ukrainian whose sales of stolen credit card information were said to have reached $11 million between 2004 and 2006 alone.

To get credit card numbers for Maksik to sell, soupnazi and his hacker friends began “wardriving” – driving around town with a laptop hooked up to a powerful antenna, looking for wireless network signals they could breach. From the parking lots of major stores like TJMaxx, Target, Barnes & Noble, and many others, they installed “packet sniffers,” software that can sit on the server undetected and grab data, like every credit or debit card transaction, from the store’s vulnerable computer network. The sniffer then sent the credit card information over the internet to one of Yastremski’s PCs in Turkey, allowing them to collect thousands of valid credit card numbers. Meanwhile, two European cohorts hacked Heartland Payment Systems, one of the largest credit card payment processing companies in the world, and stole card information from an astonishing 130 million transactions. With the two operations combined, Gonzalez and Yastremski were sitting on a virtual goldmine.

With an influx of cash, Gonzalez bought a brand new BMW, and blew thousands of dollars every weekend with his hacker friends on drinks, drugs, women, and swanky hotel suites. That year, he also threw himself a $75,000 birthday party. By this time, Gonzalez was no longer working for the Secret Service, who suspected he was up to no good but couldn’t find any evidence. Gonzalez had taught the feds much of what they knew about hacking, so he also knew how to cover his tracks. Their suspicions were confirmed when Ukrainian authorities caught up with Gonzalez’s partner, Yastremski. After searching through the files on Yastremski’s seized computers, investigators found records of over 600 instant message conversations about acquiring stolen card numbers for sale. The IM name Yastremski was talking to was registered to the email address soupnazi@efnet.ru.

Gonzalez and 10 others were indicted in federal court in August 2008. Gonzalez pleaded guilty to all charges and, in March 2010, was sentenced to 20 years in prison. It’s been estimated that the companies hit by soupnazi and his crew have spent more than $400 million to cover the damages done by these 11 men and their 11 computers.