• 'Biggest ever' case involves 130m cards
US companies and law enforcement agencies are facing fresh questions today about the ease with which hackers can penetrate their defences and make off with vital data about consumers, following the arrest and charging of a Miami man for what is allegedly the biggest credit card scam in history.
Albert Gonzalez, a 28-year-old former informant for the US secret service who helped the authorities track hackers, was charged with conspiring to steal the details of 130m credit cards. The charge sheet detailed a complex history of online skulduggery in which Gonzalez used three internet aliases: segvec, soupnazi and j4guar17, each marking different stages in his life.
The alleged fraud was perpetrated through devices that could penetrate computer networks, steal card data and send it to servers in the US and Europe, prosecutors say. The acting US attorney general, Ralph Marra, praised the investigators "in tracking down cutting edge hacking schemes committed by hackers working together across the globe".
But computer security experts suggested that the ruse allegedly devised by Gonzalez and two other accused men from eastern Europe was actually relatively simple and that the real question was the failure of the big US companies involved to properly defend their computer systems.
"None of this is revolutionary or the work of rocket scientists - it's the kind of thing we see every day," said Graham Cluley, a consultant with hi-tech security company Sophos. He added: "It seems to me that there was a concerted effort to target major retailers, and there is egg on the face of these large corporations for failing to protect their data adequately."
The charge sheet says that Gonzalez, along with two others who "resided in or near Russia", in December 2007 injected "structured query language", a computer programming language designed to retrieve and manage data, into the computers of companies such as Heartland, one of the world's biggest credit and debit card payment processing companies.
"Malware", malicious computer software, was used to identify, sort and export information.
Other companies alleged to have been attacked include 7-Eleven and Hannaford Brothers, a supermarket chain.
The charge sheet says Gonzalez "would identify potential corporate victims by, among other methods, reviewing a list of Fortune 500 companies". He would also "travel to retail stores of potential corporate victims, both to identify the payment processing systems that the would-be victims used at their point of sale terminals [eg checkout computers] and to understand the potential vulnerabilities of those systems".
If convicted, Gonzalez faces 25 years in jail. He had already been in jail after being charged last year in New York for allegedly hacking into a national restaurant chain.
The charge sheet relating to the 130m credit cards does not say if any have actually been used illegally. But Linda Foley, founder of US consumer group the Identity Theft Resource Centre, suggested criminals may have auctioned off some of the data, and the true scope of the attack might only emerge over time, with the potential to drag in financial institutions, as well as other retailers, as more details become available.
"Things may go quiet for six months, but the fear is that when the heat is off, they could start using the information again," she warned.
Gonzalez, a Cuban-American, was brought up in Coral Gables, near Miami. He avoided a conviction for credit card theft in 2003 by turning informant for the US secret service, but then allegedly resumed a life of crime.
Online magazine Wired said Gonzalez, who is alleged to have amassed about $1.6m (£965,000), had been a big spender, including $75,000 on a birthday party.
The trial is due to begin next month.
