A sophisticated hacker involved in one of the largest data theft conspiracies ever pleaded guilty Friday to 20 counts of conspiracy, computer fraud, wire fraud, access device fraud and aggravated identity theft, Department of Justice officials said.
Albert Gonzalez, 28, a Miami native and one-time Secret Service informant, entered the plea in the U.S. District Court for the District of Massachusetts in Boston following last month’s plea agreement. According to prosecutors, Gonzalez stole more than 40 million credit and debit card accounts from at least nine corporations.
Nineteen of the counts stem from an August 2008 District of Massachusetts indictment for hacks into several companies including Boston Market, Sports Authority, OfficeMax and TJX Companies, which owns discount clothing stores T.J. Maxx and Marshalls.
The remaining count of conspiracy to commit wire fraud relates to hacks into the Dave & Buster’s restaurant chain in New York, which were the subject of a May 2008 indictment in the Eastern District of New York.
The deal does not mention any agreement regarding a third case filed Aug. 17 against Gonzalez in the U.S. District Court for the District of New Jersey. Prosecutors in New Jersey allege Gonzalez and two unnamed Russian co-conspirators stole more than 130 million credit and debit cards from corporate victims that include 7-Eleven and Heartland Payment Systems, one of the country’s largest credit and debit card processing companies.
For the New York and Boston prosecutions, Gonzalez agreed to a minimum sentence of 15 years and a maximum 25 years in prison, which would run concurrent to any sentence imposed in New Jersey. He’ll also face fines that could total more than half a million dollars.
Prosecutors said a fine against Gonzalez will be determined at the time of his sentencing. His lawyer, Miami solo practitioner Rene Palomino Jr., was not immediately reached for comment.
According to the indictments, Gonzalez and his cohorts used a technique called “wardriving,” or driving around in a car with a laptop computer looking for accessible wireless computer networks of retailers.
They then sold the card numbers and committed ATM fraud by encoding data on magnetic stripes of blank cards, withdrawing tens of thousands of dollars at a time from ATMs.
As part of the plea, Gonzalez agreed to forfeit assets that include a condominium in Miami, a 2006 BMW, three Rolex watches, a Tiffany & Co. diamond ring he gave to a woman as a gift, and $2.7 million—including $1 million cash which was found buried in his backyard.
The plea agreement was originally announced August 28. For more coverage of the case, see this article from The National Law Journal.