Gonzalez: The Al Capone Of Cyber Thieves?Written by Evan Schuman and Fred J. Aun
Albert Gonzalez, the Miami resident who was indicted last summer with stealing credit card data from TJX, BJ’s Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, Forever 21 and DSW can now add Heartland, Hannaford and 7-Eleven to the lengthy list of retailers that the federal government says he penetrated. In case you feel left out, there are two to three additional major retail chains that the feds have accused him of attacking, although those chains have yet to disclose that they were breached. (That’s likely to be divulged at trial and may never come to light if Gonzalez works out a plea bargain.)
And while he is accused—along with others—of having used POS networks as his own personal ATM machine, he’s also being accused of breaking into actual ATMs (and trying to use them as his own personal POS system?).
(Editor’s Note: There is a new story published that updates this one: J.C. Penney, Target Added To List Of Gonzalez Retail Victims. Gonzalez Agrees To Plead Guilty To Key Charges.)
The indictment—handed up Monday (Aug. 17) in Newark, NJ—offered a handful of new details about the breaches, but those disclosures brought more confusion. For example, 7-Eleven is a new name in the breach circle, and the indictment said that the $54 billion convenience store chain’s POS network files were directly—and successfully—attacked. In August 2007, “7-Eleven was the victim of a SQL injection attack that resulted in malware being placed on its network and the theft of an undetermined number of credit and debit card numbers and corresponding card data,” the indictment said.
But a statement that 7-Eleven issued on Tuesday (Aug. 18) tells a very different story. The 7-Eleven statement said that “affected transactions were limited to customers’ use of certain ATMs, owned and operated by a third party, located in 7-Eleven stores over a 12-day period from October 28, 2007, through November 8, 2007.”
That’s a very key difference, given that third-party ATM data—from machines that essentially leased space from various stores—would never be in the possession of 7-Eleven. Could it be that the stolen data was only used on such machines? Seems unlikely. When the TJX indictments against Gonzalez were handed up exactly a year ago (August 2008), one unidentified major retail chain victim also spoke of ATM assaults.
Another numerical mystery created by the indictment involves Heartland. Heartland has been adamant that it has no idea at all how many cards were impacted by the breach. Monday’s indictment gave the Heartland breach a very explicit number: 130 million. Said the indictment: “Beginning on or about December 26, 2007, Heartland was the victim of a SQL injection attack on its corporate computer network that resulted in malware being placed on its payment processing system and the theft of more than approximately 130 million credit and debit card numbers and corresponding card data.”
Heartland on Monday issued its own statement, which in journalistic circles would be called a non-statement statement as it didn’t actually say anything, except to congratulate the government for bringing the indictment. But Heartland Spokesperson Jason Maloni on Monday stood by the position that Heartland does not know the number of pieces of card data impacted. Asked how the government had figures that Heartland didn’t have, Maloni referred to the government’s number and said “We don’t see what this is based on.”
There’s plenty of wiggle room for Heartland here, as the comments certainly do not dispute the government’s figures.
The indictment lays out the rough means of attack that Gonzalez and three others used to access the retail databases. The others indicted on Monday with Gonzalez were identified solely as Hacker 1 and Hacker 2. (Wasn’t that taken from an updated Cat In The Hat book?) There is also a coconspirator referenced, identified only as P.T.
There’s an excellent chance that “PT” is actually Damon Patrick Toey, who plead guilty in December to working with Gonzalez on the TJX breach and strongly suggested to the sentencing judge that he was now working with the feds against Gonzalez. (Editor’s Note: Gonzalez’s attorney, Rene Palomino Jr., was quoted in a NYTimes story posted Wednesday (Aug. 19) confirming that PT was Patrick Toey and added that one of the unnamed Russian co-conspirators was Maksym Yastremski, who is currently serving a 30-year sentence in a Turkish prison. The Times story also quoted the attorney as saying that Gonzalez was about to plead guilty to federal cyber crime charges in New York and Massachusetts when New Jersey accelerated its indictment and, in effect, killed the plea negotiations.)