Original subtitles

In this episode of American Greed, it's called Operation Get Rich or Die Trying.

The biggest ID theft in U .S. history.

A mysterious ring of social outcasts with an insatiable appetite for sex,

and your encrypted information.

There's a very fine line between exploiting a system to check it out or

exploiting a system for gain.

They were looking for data any way they could get it.

They steal credit card numbers and make a fortune by selling them on the black

market. It just kept building upon itself.

500 ,000 numbers, then a million numbers, up to 130 million numbers.

You or I might be a victim of this crime, and we would never know.

Victims lose millions, but no one pays a greater price than one of the gang's

own. It just cracked under the pressure.

In May 2008, federal agents in full SWAT gear fan out across South Florida.

They raid private homes, condos, even a suite at Miami's posh National Hotel.

We received multiple search warrants for numerous houses, cars, for safety

deposit boxes, for servers, even individuals in case they had possessed

drives or media in their pockets or in their backpacks.

Agents seize more than a dozen computers and obtain search warrants for servers

overseas. On those servers, they find millions of credit card numbers.

Their victims were a whole range from small banks and credit unions to some of

the largest retailers, well -known restaurant chains, and some of the

credit card processors in the United States.

The scheme's mastermind is 26 -year -old Albert Gonzalez.

The problem with hackers is that those who might be inclined to try to make

money off of their skills is that they don't know anything about the criminal

underworld. And the criminal underworld might not know that much about hacking,

but he could bridge both worlds.

I've always thought of him as a forerunner, sort of criminal industry

this whole area.

For Gonzalez, who also goes by the handles Soup Nazi, Kumbhajani, and

anonymity is key.

Most individuals will have more than one handle. So on one particular forum,

you'll be known as a certain individual. On another forum, you'll be known as

something else. In some places, you'll have a number. It'll be a sequence

number, a non -sequence number, depending upon what you're doing.

These criminals can communicate to one another anonymously, so a lot of times

the co -conspirators may not know each other in real life, but they communicate

via instant messaging, and they can assist each other in their crimes.

But Gonzalez is no ordinary criminal.

He'll soon be known as the most cunning cyber crook in American history.

Albert Gonzales spends his childhood in South Florida.

His father came to America from Cuba on a homemade raft in the 1970s. And they

raised him in a working class neighborhood in Miami.

Gonzales earns allowance working for his father's landscaping business.

Albert grew up in a very...

politically conservative home, church -going Catholics, in a working -class

environment. And he was a very sweet, good -natured boy, outgoing.

But all that changed when Albert was about 12 years old, and he bought his

computer. At first, his hobby seems innocent enough.

He just absolutely loved it, and he wanted to spend all his time with it.

But before long, Gonzalez's fascination with computers becomes an obsession.

His grades started dropping. His mom begged him to see a psychologist, and he

absolutely refused.

He falls in with a group of hackers called the Keebler Elves Gang, and they

into NASA and the Indian government's website.

It was about...

Being able to pick those locks and get those bragging rights to be able to say,

see, I did this. I might just be a teenager, and I might be powerless in

real world, but online, I'm like a god.

After graduating in 1999, Gonzalez enrolls in community college.

Albert dropped out of Miami Dade Community College after less than a

and moved to New York to take a job with a dot -com company, which very quickly

went under.

Then he took a job with Siemens in their IT department, but they very quickly

relocated to Pennsylvania, and he opted not to move with them.

Jobless, he begins dabbling in drugs and illegal online activity.

He was in New York sort of feeling like he had hit rock bottom and not really

knowing what his options were. What he did know was that he was really good at

hacking, and he had access to...

this internet carding forum that he was well aware of called Shadow Crew, and

that seemed like as good a career option as any.

In 2002, black market carding websites like Shadow Crew are beginning to crop

up. You go to these forums. You can buy or sell credit and debit card

information. You can buy access to retailers.

You can even hire people to launder your money off of these web pages.

These carding forums have no boundaries, and criminals from every continent join

them and participate in them.

Using the alias Kumbhajani...

Gonzalez quickly becomes a shadow crew site administrator.

He helps crooks sell more than a million stolen cards for between $10 and $15 a

piece. It's millions.

I mean, we're not talking about somebody making a couple of thousand or five,

ten, fifteen thousand. We're talking about millions and millions of dollars.

they steal a debit card number and a PIN, and they can re -encode that on

plastic, walk up to an ATM, put the PIN in, and clean out the account.

Shadow crew members call these cash -out trips.

Once that ATM is out, you go to the next one, and you continue to do that until

you're either out of cards or the ATMs are out of money.

It's a cash -out trip that would be Gonzalez's unlikely downfall.

In 2003, New York police officers see a young man loading card after card into a

nearby ATM machine.

During the arrest, officers discover he's cyber criminal Albert Gonzalez, and

they turn him over to the Secret Service.

The Secret Service is responsible for investigating cyber crime, and they very

quickly recognized Albert's potential in helping them to bust other cyber

criminals. There are places that a cooperating defendant in the cyber world

bring you that you can't go on your own, and that is the value of working with

them. The Secret Service flips Gonzalez and pays him $75 ,000 a year to help

with Operation Firewall.

It wasn't as if we were all sitting around a table together and he was

hearing, understanding our strategies, our techniques. His role was to continue

as administrator of the site, typing on a computer, communicating with his

individuals. The successful undercover sting nets 28 Shadow Crew members.

It was a benchmark investigation, benchmark prosecution, and everything

every step of the way.

Authorities say the thieves they arrested had cost more than $4 million

losses.

After Operation Firewall, the Secret Service cuts Gonzalez loose and he

to Miami.

Once a hacker, always a hacker.

Legitimacy for him was not really an option at that point because...

Albert had gained so much insight while working for the feds, and he was not a

person to pass on an opportunity.

Next on American Greed, Gonzalez forms his own gang with a plan to make

millions. He called it Operation Get Rich or Die Trying.

It certainly was a very ominous title, and it certainly foreshadowed what was

come.

Miami, Florida.

It's a playground for the world's wealthiest and for those aspiring to

all, like 23 -year -old hacker Albert Gonzalez.

In October 2004, Gonzalez turns rat and helps the Secret Service bring down

Shadow Crew, the biggest cybercrime bust to date.

But all the while, he's plotting Operation Get Rich or Die Trying.

I think it's safe to say the Secret Service had no idea that Albert was

both sides, that he was becoming a master criminal while at the same time

working as a snitch for them.

His overall business plan was to break into a series of major

retailers, obtain their credit and debit card information, and then either to

sell them or in fact use other members of his gang to...

cash them out to go to ATMs and use them as essentially cows and milk them until

they were dry.

Gonzalez enlists the help of several hackers he'd met online years before.

They started off as teenage friends trying to get into government sites,

military sites, and very quickly that changed from hacking for fun and

to hacking for profit.

A number of the collaborators of Albert Gonzalez had significant day

jobs. They were doing security intrusion work, earning tens of thousands or, in

at least one case, in excess of $100 ,000 a year in salary.

Stephen Watt, Patrick Toohey, Chris Scott, and Jonathan James become

hack pack.

Stephen Watt was a coding genius.

He graduated from high school at 16.

He graduated from college at age 19 and went on to take a job in the IT

department of Morgan Stanley, a Wall Street investment banking firm in

Manhattan.

Gonzalez meets Patrick Toohey on a shadow crew cash -out trip in 2003.

He came from a household with a shifting cast of characters and had turned to

hacking as a way to kind of funnel his alienation, his rage.

Patrick would do anything that Albert asked, from the coding to the cash -out

trips and anything in between. He probably would have picked up Albert's

cleaning if he asked him to.

Chris Scott and Jonathan James round out the gang.

Chris Scott was a depressed, overweight geek from Miami

who had been ejected from his high school for disabling all of the

with the virus.

Chris's greatest strength was probably that he was best friends with Jonathan

James, who was probably the most famous hacker at the time. He was very well

known. At 16, Jonathan James stakes his claim to fame by serving six months for

hacking into NASA and Defense Department computers, becoming the youngest hacker

ever sentenced.

Together, Gonzalez and his crew become a tight -knit band of brothers.

These guys are driven by a lot of the same things that we're driven by. They

have an ego, they like challenge, and of course they like money and everything

you can get from money.

Operation Get Rich starts small, using a technique called war driving.

So we've just gone by a really nice place that was not very well encrypted.

Chris Roberts is a gray hat hacker, an Internet security expert specializing in

fraud.

As we're driving along here, we're still pulling in a lot of wireless access

points, a lot of systems.

Some are encrypted, some aren't very well encrypted.

And we've pulled in 800 access points and almost 500 computers and systems

are attached to them.

Like Roberts, the hack pack uses a Wi -Fi antenna to find unencrypted or

vulnerable networks.

We're able to just listen in and see what kind of wireless systems are

advertising, no different than a radio. As you drive along with a radio, you go

in and out of signal strengths.

This is basically the same thing.

Chris Scott and Jonathan James tune in to one store at a time along US 1 in

Miami. They'll have pulled into every single one of these retail areas, slowly

driven through to see what wireless access points were advertising.

and then to see which ones were encrypted or which ones were not

The first one that they found was BJ's Wholesale Club, where they parked

and downloaded all of the credit and debit card numbers as they were being

swiped. by the customers.

Gonzalez forwards thousands of card numbers to Patrick Toohey and other

associates. So at that point in time, you need a little device which is a card

reader and a writer, and you also need some blank credit cards.

They then encode the information onto blanks, and runners cash them out at

Gonzalez, who was raised a Catholic, feels a slight twinge of guilt.

He told Patrick, we're going to hell for this. And he really meant it.

But he made himself feel better by telling himself that once the fraud was

detected, then the credit card companies would restore people's money and all

would be fine.

But war driving and cashing out is risky.

I physically have to put myself in a position where I might be videotaped. I

might be caught on a surveillance camera.

Somebody might be clever enough to work out that these stores are getting hit.

Albert Gonzalez himself had learned that cashing out was a dangerous mechanism

because he himself had been arrested while cashing out.

Gonzalez knows there's a better way to generate higher volume with less

exposure. He's associating with elite carters and hackers in Eastern Europe

other places, so he's trying to refine his techniques and make them even better

and less risky.

To do this, Gonzalez needs a program called a sniffer code, which he lacks

technical skills to write.

That program then, on its own, will look around your computer.

It'll look around for your social, it'll look around for your credit cards,

it'll look around for your banking information, basically whatever I've

programmed it to do.

And then it will call back to me and say, here's all the information, have a

nice day.

Gonzalez calls on Stephen Watt, who fires off the code in ten hours, free of

charge. It was really the key to this being the cybercrime of the century.

Once the sniffer code is installed, they can access, copy, and download data

remotely. And it starts to pour in.

Obviously, when you're attacking a system, when you're gathering data, you

somewhere to put this information.

You're not going to want to put it right on your computer, because if your

computer gets lost, stolen, taken, or seized, you've just handed somebody a

amount of evidence.

Gonzalez needs a safe place to stash the data.

Patrick Toohey had set up servers in Latvia, Singapore, China, and Ukraine to

store all of these reams and reams, mountains of data.

But in storage, the numbers near their expiration dates and they diminish in

value.

So he calls on an international crime lord to expedite distribution.

Maxi Khrushchev is a Ukrainian national.

who was the biggest wholesaler of credit and debit cards around the world.

Yastrzemski sells the card numbers for between $150 and $300 a pop, of which

Gonzalez takes half.

Yastrzemski would sell those cards via the Internet or in these carding forums

or portals to other lower -level salespeople who would then turn around

them again.

Yastrzemski distributes the profits to Gonzalez through online currency

exchanges. Soon, packages containing up to $370 ,000 are piling up

at Gonzalez's Dropbox.

He actually complained to Stephen Watt that once his money counter broke from

overuse, and he complained that he had to count manually $340 ,000.

By the summer of 2005, Gonzalez begins to indulge in his new lifestyle as a

mogul. It was completely over the top. I would say much of the profits from

Operation Get Rich or Guy Trying went right up their noses.

Gonzalez and his crew book a $5 ,000 a night suite at the Lowe's Hotel in South

Beach. When they were in Miami, they would make this insane concoction called

magic milkshake.

which was cookies and cream, Haagen -Dazs ice cream, skim milk, magic

LSD, and ecstasy, all blended together to create just the most

extreme, insane experience ever.

Gonzalez also throws himself an extravagant party to celebrate his

New York City.

Lay out a drug buffet on the coffee table. So C for Coke, E for ecstasy.

They had the best champagne.

They had the best designer drugs.

They had the most beautiful women there. It was like life as they would design

it. Despite this drug -fueled lifestyle, Gonzalez never loses control of his

business. He was always reachable.

He slept with his laptop next to him. He brought his laptop with him on

vacation, to the gym. He always had it with him.

Next on American Greed, Operation Get Rich or Die Tryin' gets more

sophisticated, and the hackers up the ante.

The idea that these guys were able to slip past all of these levels of

security was just incredible.

And the hackers take one company to the brink.

What do you do when you're facing the worst possible thing that can happen to

your company?

By 2005, Albert Gonzalez and his crew have successfully hacked into several

retailers along US -1 in South Florida.

These big box stores send data to corporate servers, which Gonzalez knows

real goldmine.

It's very much a case of like, well, hang on, if I can do it to these couple

individuals in a store, or if I can do it to these couple of stores, can I do

to more stores? Can I do it to a series of stores? Can I do it to a bigger

store? And then you go to, can I actually get the core centralized

then it's like, wow, okay.

If I can get the core system, who processes all the data? I can go for the

mother load at that point. He orders his crew to perform reconnaissance on

potential targets.

They identified them in a variety of ways. Christopher Scott simply going up

down Route 1 with his computer, seeing where there were vulnerable access

points, going down the list of Fortune 500 companies, identifying companies

shared a common credit card processing system.

We're identifying ones that had vulnerable payment systems.

So they'd walk in, maybe make a purchase, or just walk in and look to

point -of -sales terminal the stores were using so they could reverse

how to break into the corporate networks through these different point -of

-sales terminals.

That July, they hit TJX Companies, the publicly traded parent of Marshalls and

TJ Maxx.

Christopher Scott breaks into two vulnerable wireless access points at two

Marshall stores along Route 1 in Florida. Within a matter of weeks, he's

move from there into one of the major payment card processing servers that TJX

is using.

You have access at that point in time to the corporate site because now you have

all of these stores that are sending their daily, weekly, monthly batches all

the way up to the corporate location.

Chris Scott, Gonzales' foot soldier, explores the network.

He gets increasing amounts of rights or privileges to move around the system and

discovers a storage location that has 40 or 50 million payment card numbers.

They download that batch of data.

But Gonzalez isn't satisfied.

He wants access to all the numbers coming into TJX, not just the numbers in

storage. In May 2006, Chris Scott installs and configures a VPN, or

Virtual Private Network.

Albert's crew had set up a virtual private network, which is a secure

between TJX's server and one of Albert's servers.

So whenever they wanted to, they could just tap that keg, open up the

connection, and let the data stream from TJX's server right onto Albert's.

Scott then installs a snipper code, the program that copies numbers while

they're being processed.

It turns out that there's a very tiny window of time when the...

Credit and debit card numbers aren't being encrypted when it happens to be in

the open as it's being processed.

And it's during that period that they make a photocopy of it all for

Using the handle 201679996, Gonzalez instant messages

Maxim Yastrzemski, his Ukrainian partner in crime.

In that chat, he mentioned the sniffer code.

Soon, Yastrzemski could expect more data.

Business is booming for Gonzalez, whose crew downloads more than 45 million card

numbers through December 2006.

If you shopped at any of these retail stores during that period of time,

a very good chance that your credit card or debit card was compromised.

That Christmas, more than 18 months after Gonzalez's crew first hit TJX, the

retail giant detects suspicious software on its systems.

Alarm bells sound, and the feds begin to investigate.

We didn't know if it was one individual, if it was several different groups

doing these compromises.

What did we know from the forensics as to where it was going? Did it look like

anybody else that we'd ever seen? All of these things were being carefully

followed out, wholly, I'm embarrassed to say, unsuccessfully.

By January 2007...

Gonzalez has pulled in more than 45 million credit and debit card numbers

TJX, and he decides to get out of the corporate system.

The trouble is beginning to brew half a world away.

The Secret Service had been conducting a totally separate and totally unrelated

investigation into Maxim Yastrzemski for his international sale of credit and

debit card numbers.

Turkish authorities arrest Maxim Yastrzemski that July.

That leads to the seizure of a laptop computer, which the Turks provide to the

Secret Service.

When they opened up his computer, they found all kinds of things, including

of chat logs with an American who went by an obscure string of numbers.

201 -67 -9996 is passing on a piece of software and

says... It's one that I modified for use in TJX.

And that starts the investigation of who 201 is and how Maxim Yastrzemski

relates to TJX and to other investigations.

They find further chats about a breach of Dave & Buster's, the entertainment

chain. Maszak Yastrzemski said he had another hacker who was into a company

named D &B in the United States.

Yastrzemski had asked 201 to provide a sniffer code to capture Dave and

credit card data.

That sniffer program was the same sniffer that was utilized in the TJX

that was our first clue that 201 -67996 may have been involved with TJX. The

feds followed these leads for months.

Just as Gonzales heads into the final phase of Operation Get Rich, with

Yastrzemski behind bars, Gonzales decides to keep a closer eye on his

associates, especially Patrick Toohey, his right -hand man.

It was more important than ever that he exert as much control as possible over

all of the variables.

In August, Gonzales moves Toohey into his Miami condo.

It's a far cry from the hotel suites they've partied in before.

It was a dump. In part, it was because he wanted to live under the radar,

because he understood from his experience with law enforcement that

money is one of those things that gives you away.

It's different, though, from some of the hackers we've seen in Eastern Europe

where they'll buy a restaurant, they'll buy a housing project or complex,

they'll buy million -dollar apartments.

That wasn't this crew here.

They might buy a few nice computers or recreational items, but they're not

living in the million -dollar apartments in Manhattan.

By late fall, Operation Get Rich progresses from more driving to more

complicated web -based hacks.

Gonzalez conspires with TUI and two Russians to commit a series of other

intrusions using a diabolical plan known as a SQL injection attack.

SQL injection attack is an internet -based attack on a website that's

-driven. So the most important difference is you don't need that

proximity anymore.

to conduct these types of remote hacks into systems. You can be sitting in

and do a SQL injection, internet -based attack on a computer system in

California.

Coming up, Gonzalez and his co -conspirators go to the motherlode and

credit card processing company, their biggest prize yet.

They were in a position to...

accessed tens of millions of payment card numbers quickly, and that was a

goose. So the hack is the credit card processing company. It's like the Holy

Grail at that point in time.

By December 2007,

Operation Get Rich or Die Tryin' has entered its most ambitious phase yet.

Albert Gonzalez and his co -conspirators target several companies, including

Heartland Payment Systems, one of the world's largest payment processors.

We process for about 250 ,000 locations in America and a few in Canada,

and we process about 4 billion transactions a year.

Bob Carr is the founder, chairman, and chief executive officer of Heartland

Payment Systems.

There's no doubt that people who process billions of transactions are the mother

load of data, that's for sure.

When we were doing our initial public offering of stock on the roadshow, the

question everyone asked is, what keeps you awake at night? And my answer was

always getting breached.

But Carr is totally unaware that his worst nightmare is coming true.

Gonzalez and Patrick Toohey invisibly hack into Heartland.

using a sequel injection attack.

If I were to walk up to you on the street and say, can you tell me the

you'd tell me the time.

But if I were to walk up to you on the street and say, can you tell me your

name, address, social security number and mother's maiden name, then you're

going to do that.

You're smart enough to know the difference between information you

out and information you shouldn't give out.

Whereas with...

A website that's subjected to a SQL injection attack, it's not programmed to

correctly recognize which commands it should obey and which commands it should

ignore. They install a sniffer code to copy data in small, well -timed chunks.

From there, it was a matter of having that sniffing software work and send the

payment card information, the credit and debit card information out to...

Hacking platforms in foreign countries and in the United States that could be

used to receive and store the card data that was stolen, but also the malware,

the software that was used to sell it.

For months, the hackers tap into Heartland's network.

You don't want to turn the spigot on the whole way and just drain the thing

immediately. You want to take a little bit of time and keep on taking it.

They access more than 130 million credit and debit card numbers.

These bad guys spent.

Hours and hours and hours for months and months and months trying to figure out

and customize an attack that would get through and get into our payments

network, and they were able to do that.

Back at the Secret Service, agents have been combing through Maxim Yastrzemski's

computer.

They find chats referring to someone with the initials CJ.

CJ is short for Kumbhajani.

which is the name we had Gonzalez use when he was an informant in Operation

Firewall. It's a very small connection, very much at the periphery, but we had

one or two of those little indications start to unravel.

They also learn the Ukrainian crime lord has been chatting with a mysterious

American, 201 -67 -9996, who was somehow involved in the

TJX hack.

201 -679 -996 is connected to an email address, supnazi at

efnet .ru.

And the Secret Service recognizes that email address as one that has been used

previously by Albert Gonzalez. For the first time, there was a major lead.

Shockwaves ripple through the Secret Service.

Is Gonzalez playing both sides?

While Albert is masterminding this incredible cybercrime, he is still

an informant for the Fed.

Agents move quickly to secure warrants to arrest Gonzalez and his crew.

And by now...

Gonzalez knows the heat is coming down.

When you were involved with someone that gets arrested, you're going to be more

apprehensive. And we had seen in the chats that 201 person being apprehensive

about that situation.

So he most likely knew from reading public information about our cases,

things that we were closing in.

On May 7, 2008, after nearly a year -long investigation,

The feds go after their informant.

These young kids had access to documents that would allow them to immediately

flee the country.

And we were very, very concerned that Gonzalez was going to be one of those,

once he was gone, we would never get him back.

About 150 agents scour Gonzalez's condo, his parents' house, and several other

residences.

From Gonzalez's condominium.

There was multiple computers and media that was seized, a large quantity of

from Gonzalez's parents' residence.

We seized a number of computers, documents, a money counter.

But Gonzalez is nowhere to be found.

When they arrived at the place where they thought Albert Gonzalez would be,

his parents' house or his girlfriend's house, he was neither.

And that's when the panic began.

On a tip, they search a suite at the National Hotel in Miami's South Beach,

where they find Gonzalez, along with two laptops, $22 ,000 in cash, and a Glock

27 handgun.

They arrest Gonzalez and Christopher Scott that same day.

Patrick Toohey is arrested soon after.

Patrick knew he was sunk. He knew that he and the entire operation, they were

just dead meat. He started talking immediately.

After Albert discovered that Patrick was cooperating, Albert himself became very

cooperative, and he led them to a lot of information, including he told them

where the money was buried in his parents' backyard.

Investigators return to Albert's childhood home, where they search the

They find a barrel buried beneath a palm tree.

Once the earth was unsealed, inside was over $1 million of vacuum -packed cash.

Gonzalez has stashed $1 .1 million in plastic bags for safekeeping.

Soon, the feds unearth more secrets about the case.

When we executed those search warrants, one of the individuals spoke and said

that Albert Gonzalez used the nickname Segveg.

And that was the evidence we were looking for to get us over the edge and

able to indict him.

Segveg. The handle Gonzalez used during chats with Yastrzemski about Dave and

Busters clinches it for the feds. Finally, really, we're starting to

understand all these data breaches we had seen happen over the years. It was

really exciting.

It was shocking.

A few weeks later, the criminal complaint against Gonzalez is posted

it rocks the hacking underworld.

This is a very close community of hackers.

These are people you have to remember who are very alienated from the rest of

society. They feel that all they have is each other.

24 -year -old Jonathan James, Gonzalez's former war driver, was shocked to learn

that his boss has been working for the Secret Service since 2003.

There's just been this nice set of clicky groups, and you can trust

and now you're like, well, whose side are you on?

James, who had become famous for hacking as a teen, believes his friends will

rat him out.

Coming up, James takes matters into his own hands, and Operation Get Rich or Die

Tryin' takes a deadly turn.

He did not want to have that kind of heat on him again, and the idea that

were now turning on each other, it was intolerable to him.

In May 2008, with Albert Gonzalez and his hack pack behind bars, the feds

to shore up their case.

But Jonathan James, one of Gonzalez's war drivers, is still free.

And he jumps to the conclusion that Gonzalez is going to set him up. He said

that he was sure that he was going to be the scapegoat for this crime, given his

notoriety, and also given that he knew that Albert...

was a government cooperator, and he was sure that Albert was going to pin the

crime on him.

James pens a letter titled Storytime.

In it, he says he had nothing to do with the hats.

He couldn't bear the idea that they were all betraying each other. Once these

hackers turned on each other, they had nobody left.

Remember, it's not whether you win or lose, it's whether I win or lose. And

sitting in jail for 20, 10, or even 5 years for a crime I didn't commit is not

me winning.

I die free.

Minutes later, he picks up a handgun, points it to his temple, and pulls the

trigger.

If he, in fact, played a part in this crime, he played a very small part, and

it's not clear whether he would have been indicted had he not killed himself.

The feds file more indictments against Gonzalez and his crew in August 2008.

And for the first time, the scope of the crime becomes clear.

We had to keep replacing our press releases. This is the most significant,

largest data breach we've had. It just kept building upon itself.

500 ,000 numbers, then a million numbers.

The first indictment is filed in New York for the Dave and Buster's breach.

The second in Massachusetts.

for the hacks into TJX companies, BJ's Wholesale Club, OfficeMax, and several

other businesses.

But despite being in jail, Gonzalez is still wreaking havoc on the outside.

In October 2008, credit card companies warned Heartland Payment Systems of

suspicious activity.

We hired forensics companies to help try to find it. We got a report that there

were no problems found, so we thought we were in the clear.

When forensics companies tell you that they can't find anything and they do

for a living, you get some sense of comfort that there's not a problem.

Three months go by, and in January 2009, Heartland chiefs get the call they've

been dreading.

Someone had found data in our system that could not be explained, data that

did not create.

In the next couple of days, we learned that there was malware that was creating

this data.

And that turned out to be the card numbers that were put into files that

compressed. I knew it would be disastrous for a lot of the stockholders

company, including me.

Heartland goes public with news of the breach days later.

Another big story at 6. A credit card processing company gets hacked into.

The company's stock plummets from about $16 a share to less than $4.

But the loss is really much greater.

We've reported losses of $139 million that we've paid out or booked that we

pay out. So we suffered a net $110 million loss, and we still don't know if

we're finished. We probably are not, but we think the bulk of it is behind us.

In focus this evening, security in cyberspace.

A lot of people will look at Heartland, and they don't want to be the next

headline on CNBC.

So they're going to be quite careful, too.

improve the standards and make sure that they're defending themselves.

In August 2009, Gonzalez, Patrick Toohey, and two unnamed Russian hackers

indicted in New Jersey for conspiring to break into Heartland and several other

companies. Software has sort of a digital fingerprint, a kind of digital

And in the process of investigating it, if it has that same DNA, there's a link

between those two victim sites.

And what we ended up with was...

enough similarities between the five victim sites to know that we were

with one hacking crew.

But much about the case remains a mystery, like how many credit card

were stolen.

There were tens of millions more at TJX and in excess of 100 million at

Heartland that could have been taken, but nobody knows the exact number.

And how much money Gonzalez and his crew ultimately earned from their hacks.

They're young kids. They spent a lot of money.

They spent a lot of money on partying, a lot of money on drugs, fun nights out,

spending $80 ,000. So it's hard for us to know if they didn't just spend most

it, too.

Prosecutors do know that victims lose at least $400 million, and restitution is

set at $172 million.

Gonzalez, with his team, committed the largest identity theft.

ever prosecuted in the United States and perhaps the world.

The dollar loss was so large that it changed the behavior of corporations as

they realized that they had to increase the level of security because there was

a large dollar risk involved.

So it was changing to the whole culture in the size of what he did.

Patrick Tuohy, Stephen Watt, Chris Scott and Maxim Yastrzemski.

all served multi -year sentences in prison.

And as for Gonzalez... He agreed to plead guilty to all of them and

received a 20 -year sentence to run on each of them at the same time.

Restitution well in excess of $100 million and forfeiture of jewelry,

computers, and over a million dollars in cash that had been dug up in his

parents' backyard.

At sentencing, Gonzalez's attorney argues these were not crimes of greed.

Rather, that Gonzalez suffers from Asperger's syndrome, a mild form of

which could explain his addiction to computers.

People with Asperger's are unable to relate to other people. Whereas Albert

a natural leader.

He, by definition, could relate to other people, size them up, negotiate with

them. squeeze work product out of them. He was the exact opposite of somebody

with Asperger's.

Court -appointed psychologists find no evidence of the disorder.

These guys spent a lot of time on their computers, but so does about half to two

-thirds of all the students at nearby MIT.

So the fact that you spend a lot of time on your computer as a kid, that you

communicate with others on your computers, does not justify crime.

In the end, What begins as teenagers hacking for fun soon becomes the

cybercrime in history, an operation that lives up to its name.

When Albert called this caper Operation Get Rich or Die Trying, I'm sure he

didn't actually intend for anyone to die.