T.J.Maxx hacker sentenced to 20 years in prison

Albert Gonzalez, who pleaded guilty to snatching customer credit card numbers from T.J.Maxx, BJ's Wholesale Club, and Barnes & Noble, faces decades in prison.

Declan McCullagh Former Senior Writer
Declan McCullagh is the chief political correspondent for CNET. You can e-mail him or follow him on Twitter as declanm. Declan previously was a reporter for Time and the Washington bureau chief for Wired and wrote the Taking Liberties section and Other People's Money column for CBS News' Web site.
Declan McCullagh
2 min read

Albert Gonzalez, the computer hacker behind one of the largest known identity fraud cases in U.S. history, was sentenced on Thursday to 20 years in federal prison.


Gonzalez, a 28-year-old college dropout and Secret Service informant known as "soupnazi," had confessed to stealing millions of credit card and debit card numbers from major U.S. retail chains, including T.J.Maxx, BJ's Wholesale Club, and Barnes & Noble.

U.S. District Judge Patti Saris in Boston sentenced Gonzalez to the middle of expected prison sentences for charges filed in Massachusetts and New York, which ranged from 15 to 25 years.

Christina Sterling, a spokeswoman for the U.S. Attorney's office in Massachusetts, told CNET that Gonzalez will be sentenced on Friday for additional charges filed in New Jersey.

In an 11-page plea agreement (PDF) last year, Gonzalez admitted to unlawfully accessing a computer, wire fraud, identity theft, and other crimes. He agreed to forfeit a Miami condo, a 2006 BMW 330i, a Tiffany diamond ring, three Rolex watches, and more than $1.65 million in cash.

In August 2008, prosecutors accused Gonzalez, along with 10 others from the United States, Eastern Europe, and China, of breaking into retail credit card payment systems by wardriving--that is, using a laptop to detect retailers' unsecured wireless networks--and installing sniffer programs to capture data.

Gonzalez and his alleged co-conspirators sold the credit numbers, encoded the data onto magnetic stripes of blank cards, and used the new cards to withdraw tens of thousands of dollars at a time from ATMs, prosecutors said. They also allegedly concealed and laundered their proceeds by using anonymous Internet-based currencies within the United States and abroad, and by channeling money through bank accounts in Eastern Europe.

Separately, New Jersey prosecutors say Gonzalez conspired to steal credit card numbers from Heartland Payment Systems, 7-Eleven, and supermarket chain Hannaford Bros.

Gonzalez was reportedly paid $75,000 a year by the Secret Service to work as an undercover informant to guide agents through the illegal, clandestine marketplaces where credit and debit card numbers are sold.