Hacker pleads guilty in data theft

More than 40m numbers taken from TJX, others

Albert Gonzalez is to be sentenced on Dec. 8 Albert Gonzalez is to be sentenced on Dec. 8
By Todd Wallack
Globe Staff / September 12, 2009

E-mail this article

Invalid email address
Invalid email address

Sending your article

Your article has been sent.

  • Email|
  • Print|
  • Reprints|
  • |
Text size +

Albert Gonzalez, the 28-year-old hacker accused of orchestrating the biggest cyber-crime in history, pleaded guilty yesterday in federal court in Boston to 20 counts of conspiracy, fraud, and other charges for stealing millions of credit card numbers from major retailers.

The Miami man was charged in Massachusetts last year with helping to steal more than 40 million credit card numbers from TJX Cos. of Framingham - which operates the T.J. Maxx and Marshalls stores - BJ’s Wholesale Club, the Boston Market food stores, and other chains. The agreement yesterday included his guilty plea to a charge related to his breaking into the network of the Dave & Buster’s restaurant chain and stealing accounts.

Gonzalez is scheduled to be sentenced on Dec. 8, if a federal judge approves the plea agreement. He faces 15 to 25 years in federal prison, plus a possible fine and other restitution.

“He is working to put this behind him,’’ said his attorney, Rene Palomino Jr. of Miami. “He is extremely remorseful.’’

Gonzalez himself said little in court yesterday, as is typical when defendants enter a plea. Wearing olive-shaded prison clothes and wire frame glasses, Gonzalez gave brief answers to US District Court Judge Patti B. Saris’s questions and occasionally took notes. His once flowing mane of black hair was trimmed to medium length. He is currently being held in federal custody in Rhode Island.

Gonzalez still faces charges in New Jersey. Last month, federal prosecutors there charged him with being the mastermind behind the theft of more than 130 million credit and debit cards from the computer network for Heartland Payment Systems, one of the country’s largest processors of credit and debit card payments, as well as from several major retailers, such as the 7-Eleven convenience store chain and grocery chain Hannaford Bros. Co.

Prosecutors believe the New Jersey case represents the largest credit card heist in history.

In the New Jersey case, Gonzalez faces up to 35 years of prison time and $500,000 in fines on charges of conspiracy and wire fraud conspiracy. Palomino said he is negotiating a plea bargain to settle that case as well.

A former altar boy who grew up in a family of working-class Cuban immigrants in Miami, Gonzalez allegedly got into trouble at an early age, when federal agents came to his high school to question him about his computer use. He was arrested in 1993 in New Jersey in connection with ATM theft, but avoided prosecution by agreeing to become a government informant. Government officials said they later discovered he was double-crossing them, by trying to break into networks and tipping off friends about undercover investigations.

US Assistant Attorney Stephen Heymann said Gonzalez and his partners participated in “some of the largest and most serious identity thefts in the nation’s history.’’ Heymann said BJ’s Wholesale Club was the first major victim, but the crime soon spread to other major retailers, such as TJX.

Gonzalez allegedly used money from selling the credit card account data to fuel an expensive lifestyle. He once lamented he had to tally nearly $340,000 in $20 dollar bills by hand when a counting machine broke, and threw a $75,000 birthday party for himself, according to court records.

But that came crashing to a halt in May 2008 when Secret Service agents arrested him at the luxurious National Hotel in Miami Beach, where he was staying with his girlfriend.

As part of the plea agreement, Gonzalez agreed to surrender more than $1.6 million in cash, including $1.1 million found buried in his parents’ backyard in Miami, a blue BMW 330i, a small condo, several computers, and a Glock 27 handgun. He also agreed to return a Tiffany diamond ring he gave his girlfriend and Rolex watches he gave to his father and friends.

Prosecutors said the assets were fairly modest compared with the amount of money victims lost, which will make it impossible to fully compensate victims. TJX alone has spent more than $132 million on expenses related to the breaches, including the cost to investigate and contain the intrusion and for lawsuits and other legal claims. It has also set aside $39.5 million to handle further legal claims.

Judge Saris said it would be difficult to figure out how to parcel out the money recovered from Gonzalez so far, as well as how to reach out to all the possible victims affected by the crimes, to give them a chance to weigh in on the sentencing.

Heymann said prosecutors plan to post information for victims online, but do not expect many to speak at the sentencing hearing.

Gonzalez has been called a ringleader in the case. But yesterday, prosecutors also cited the names and roles of several other people who allegedly participated in the heists, some of whom are already in custody. And Gonzalez’s attorney said he was just one of several people who participated in the crime.

“I call him a coconspirator,’’ Palomino said. “No one person could carry out all these acts.’’

Todd Wallack can be reached at