U.S. Busts Largest-Ever ID-Theft Scheme

The Justice Department announced Monday charges in what it said was its biggest identity theft case ever. Prosecutors say a Miami man stole information on more than 130 million credit and debit accounts.

Copyright © 2009 NPR. For personal, noncommercial use only. See Terms of Use. For other uses, prior permission required.

MELISSA BLOCK, host:

Today, the Justice Department announced what it called the largest hacking and identity theft case ever. Prosecutors say hackers stole more than 130 million credit card and debit card numbers. NPR's Ari Shapiro is covering the story. He joins us now.

And Ari, first off, whose information was stolen here?

ARI SHAPIRO: Well, there were three companies named in the indictment that were victimized by these hackers. One was 7-Eleven, the convenience store chain, another was a supermarket company called Hannaford Bros., and the third was a card payment processor called Heartland Payment Systems. There were also two unnamed corporate victims. And according to the indictment, between 2006 and 2008, hackers broke into their computer systems and stole all this information.

BLOCK: What information exactly? What did they steal?

SHAPIRO: Well, it was credit and debit card numbers, and it's important to mention that we're not talking about Social Security numbers. So this is not the worst kind of wholesale identity theft that we have seen in some other cases.

In the worst case for victims, maybe their bank accounts were emptied, but the bank or the credit card company would reimburse that because almost every major bank and credit card company takes responsibility when there are fraudulent charges of this sort. It's much worse for the credit card companies that are now having to replace credit card numbers for some 130 million or more victims because of this massive theft.

BLOCK: And so far at least, federal prosecutors have charged one man in the case. What can you tell us about him?

SHAPIRO: His name is Albert Gonzales. There are actually two unnamed co-conspirators from Russia who were also charged, but we don't have their names. Albert Gonzales is a 28-year-old from Miami. And he has been in jail for about a year because this is not the first indictment against him. About a year ago, he was accused of similar crimes against the restaurant chain Dave & Buster's. There was another indictment against him for similar crimes with the T.J. Maxx clothing company.

When the T.J. Maxx indictment came down, it was the largest hacking and identity theft case of its time. It was 45 million victims. This one is three times that many.

BLOCK: Oh. So assuming my bank account hasn't been emptied…

(Soundbite of laughter)

BLOCK: …that would be one sign that my identity had been stolen, or my credit card number was stolen. What would another sign be that this hacker had gotten my number?

SHAPIRO: Well, unfortunately, I can't tell you whether your identity was stolen or not. But the good news is 45 states and the District of Columbia have laws saying when your identity is compromised, you have to be notified. So presumably, these 130 million or so victims will soon find out. And the bad news is once you swipe your credit card, there's little you can do to make sure this kind of crime doesn't happen to you.

BLOCK: Okay. Thanks, Ari.

SHAPIRO: You're welcome.

BLOCK: That's NPR's Ari Shapiro talking about what the Justice Department is calling this country's largest ever hacking and identity theft case.

Copyright © 2009 NPR. All rights reserved. No quotes from the materials contained herein may be used in any media without attribution to NPR. This transcript is provided for personal, noncommercial use only, pursuant to our Terms of Use. Any other use requires NPR's prior permission. Visit our permissions page for further information.

NPR transcripts are created on a rush deadline by a contractor for NPR, and accuracy and availability may vary. This text may not be in its final form and may be updated or revised in the future. Please be aware that the authoritative record of NPR's programming is the audio.

Comments

 

Please keep your community civil. All comments must follow the NPR.org Community rules and terms of use, and will be moderated prior to posting. NPR reserves the right to use the comments we receive, in whole or in part, and to use the commenter's name and location, in any medium. See also the Terms of Use, Privacy Policy and Community FAQ.

Support comes from: