U.S. Busts Largest-Ever ID-Theft Scheme
MELISSA BLOCK, host:
Today, the Justice Department announced what it called the largest hacking and identity theft case ever. Prosecutors say hackers stole more than 130 million credit card and debit card numbers. NPR's Ari Shapiro is covering the story. He joins us now.
And Ari, first off, whose information was stolen here?
ARI SHAPIRO: Well, there were three companies named in the indictment that were victimized by these hackers. One was 7-Eleven, the convenience store chain, another was a supermarket company called Hannaford Bros., and the third was a card payment processor called Heartland Payment Systems. There were also two unnamed corporate victims. And according to the indictment, between 2006 and 2008, hackers broke into their computer systems and stole all this information.
BLOCK: What information exactly? What did they steal?
SHAPIRO: Well, it was credit and debit card numbers, and it's important to mention that we're not talking about Social Security numbers. So this is not the worst kind of wholesale identity theft that we have seen in some other cases.
In the worst case for victims, maybe their bank accounts were emptied, but the bank or the credit card company would reimburse that because almost every major bank and credit card company takes responsibility when there are fraudulent charges of this sort. It's much worse for the credit card companies that are now having to replace credit card numbers for some 130 million or more victims because of this massive theft.
BLOCK: And so far at least, federal prosecutors have charged one man in the case. What can you tell us about him?
SHAPIRO: His name is Albert Gonzales. There are actually two unnamed co-conspirators from Russia who were also charged, but we don't have their names. Albert Gonzales is a 28-year-old from Miami. And he has been in jail for about a year because this is not the first indictment against him. About a year ago, he was accused of similar crimes against the restaurant chain Dave & Buster's. There was another indictment against him for similar crimes with the T.J. Maxx clothing company.
When the T.J. Maxx indictment came down, it was the largest hacking and identity theft case of its time. It was 45 million victims. This one is three times that many.
BLOCK: Oh. So assuming my bank account hasn't been emptied…
(Soundbite of laughter)
BLOCK: …that would be one sign that my identity had been stolen, or my credit card number was stolen. What would another sign be that this hacker had gotten my number?
SHAPIRO: Well, unfortunately, I can't tell you whether your identity was stolen or not. But the good news is 45 states and the District of Columbia have laws saying when your identity is compromised, you have to be notified. So presumably, these 130 million or so victims will soon find out. And the bad news is once you swipe your credit card, there's little you can do to make sure this kind of crime doesn't happen to you.
BLOCK: Okay. Thanks, Ari.
SHAPIRO: You're welcome.
BLOCK: That's NPR's Ari Shapiro talking about what the Justice Department is calling this country's largest ever hacking and identity theft case.