BOSTON – The hacker responsible for the biggest data breaches over the past five years on Friday was sentenced to 20 years and one day in prison for helping steal data on millions of accounts from Heartland Payment Systems, but the sentence will run concurrently with the 20-year term drawn the day before for breaking into databases at TJX Cos., BJ’s Wholesale Club, Office Max, Dave & Busters, Barnes & Noble and a string of other companies.
On Friday, U.S. District Court Judge Douglas Woodlock sentenced Albert Gonzalez to 20 years and a day in prison, plus a $25,000 fine, for his role in stealing an estimated 130 million card numbers from Heartland, one of the nation's largest processors of credit and debit card payments, as well as the 7-Eleven convenience store chain and Hannaford Brothers Corp., a regional grocer based in Maine. Gonzalez also was sentenced for hacking the computer systems of two additional, unnamed retailers.
The series of data thefts cost retailers, insurers, credit unions and banks an estimated $200 million, according to authorities.
"Gonzalez was at the center of the largest and most costly series of identity thefts in the nation’s history," government attorneys noted in a brief filed with the court. "He knowingly victimized a group of people whose population exceeded that of many major cities and some states – certainly millions upon millions, perhaps tens of millions."
But while Gonzalez acknowledged his role as the central figure in the TJX case, he had only a "peripheral" role in the Heartland case, according to a brief filed by his attorney, Martin Weinberg of Boston.
"Gonzalez did not even know of the Heartland intrusion prior to its occurrence," Weinberg wrote, adding Gonzalez's role was limited to allowing two other unnamed hackers to use certain computers he controlled, and on one occasion, asking a friend to modify malicious software.
"He had no other involvement in either the Heartland or Hannaford intrusions," Weinberg wrote, "and only minor and insignificant further involvement with the 7-Eleven intrusion."
The data thefts occurred while Gonzalez, now 28, was working as an undercover informant for the U.S. Secret Service, who enlisted him after he was arrested for data theft in 2003.
