The Channel Wire

August 20, 2009

Albert Gonzalez, the accused mastermind of a hacking and identity theft ring most recently indicted for stealing more than 130 million credit and debit card numbers, was inching toward a settlement with federal prosecutors that would have ended investigations into his previous crimes, according to reports.

The New York Times quoted Gonzalez's lawyer, Rene Palomino Jr., in a Wednesday story, as saying Gonzalez was negotiating for and soon to agree to a prison sentence of around 20 years for his previous crimes. Thanks to the new round of indictments, in which Gonzalez and two Russian co-conspirators were nailed for alleged hacks of Heartland Payment Systems, Hannaford Bros., 7-Eleven and two other companies, those talks are off.

"We are giving it our best shot trying to resolve these cases and to prevent the government from wasting all these millions of dollars to bring to trial all of these cases," Palomino said to the Times, also suggesting that prosecutors wanted to "bask in the glory of all the publicity they are getting from this."

Prosecutors and the credit- and debit-card-using public might see it a little differently. Gonzalez, a 28-year-old Miami resident, was arrested last year for his role in the high-profile hacking jobs of TJX and other companies like Dave & Busters, for which he was supposed to stand trial starting in September.

The new round of indictments came Monday, detailing how Gonzalez and his ring would target Fortune 500 companies, gain access about those companies' point-of-sale systems, and coordinate attacks using SQL injections, malware, sniffers and instant messaging from remote locations. According to prosecutors, the 130 million number applies to just the card numbers Gonzalez and his cohorts swiped from Heartland and Hannaford.

In his interview with the Times, Palomino also identified some of Gonzalez's partners, including Damon Patrick Toey, one of the 11 men named in last year's TJX indictment. Palomino also said one of the Russian men named on the new indictment is Maksym Yastremski, who is already serving 30 years in a Turkish prison.

Palomino expressed frustration that the new indictment disrupts what he called a "best effort to save the government a lot of money and man-hours."

The Gonzalez case is expected to refresh the debate over prevention measures and secure point-of-sales systems for major retail chains. For a look at recent technology designed to prevent these types of breaches, check out Six Products That Might Have Thwarted The Credit Card Data Heist.