Goto The Great Cyberheist - 10

Peretti knew that if they didn’t find him soon, he would disappear. “Albert had said during Firewall how afraid he was of spending any time in prison,” she said. “I knew he’d be gone the next day.”

They found him at 7 in the morning on May 7, 2008, when agents rushed into his suite at the National Hotel in Miami Beach. With him were a Croatian woman, two laptops and $22,000. Over time, he started talking. Months later, he led Secret Service agents to a barrel containing $1.2 million buried in his parents’ backyard. Attorney General Michael Mukasey himself held a news conference in August 2008 to announce the indictment. “So far as we know, this is the single largest and most complex identity-theft case ever charged in this country,” he told reporters. Gonzalez’s attorney assured him the government’s case was weak. Electronic evidence often didn’t hold up, he said.

That was before attorneys for Heartland Payment Systems Inc., in Princeton, N.J., called Peretti in early January 2009. One of the largest card-payment processors in the country, Heartland, which services about a quarter of a million businesses, had been hacked. But not just hacked — owned in a way no company had ever been owned. As Peretti would soon learn from Gonzalez, he had helped the two Eastern European hackers, Annex and Grig, slip into Heartland via SQL injection. By the time Heartland realized something was wrong, the heist was too immense to be believed: data from 130 million transactions had been exposed. Indictments were brought against Gonzalez in New Jersey, New York and Massachusetts (where the cases were eventually consolidated). At a loss for anything else to say, Gonzalez’s attorney told a reporter: “He’s really not a bad guy. He just got way in over his head.”

On May 18, 2008, Jonathan James shot himself in the head. He left a suicide note saying he was convinced the government would try to pin Gonzalez’s crimes on him because of the notoriety James had gained as a teenage hacker.

AT HIS SENTENCING in March, Gonzalez, who pleaded guilty to all charges, sat almost motionless. As far as I saw, he didn’t once look back at the gallery in the federal courtroom in Boston, where his mother sat stoically while his father wept into a handkerchief as Gonzalez’s sister consoled him. Nor did he glance at Heymann, as he told the court that Gonzalez had committed the worst computer crimes ever prosecuted; nor at Peretti, nor his old colleagues from the Secret Service, who also sat in the gallery. Gonzalez just leaned forward and peered straight ahead at the judge, as though — the set of his head was unmistakable — staring intensely at a computer.

He spoke just once, a few sentences at the end. “I blame nobody but myself,” he said. “I’m guilty of not only exploiting computer networks but exploiting personal relationships, particularly one that I had with a certain government agency who believed in me. This agency not only believed in me but gave me a second start in life, and I completely threw that away.” Accounting for time served and good behavior, Gonzalez is expected to get out of prison in 2025.

In May, Toey began a five-year sentence, and Scott started a seven-year sentence. Yastremskiy was given 30 years in a Turkish prison, a fate apparently so grim he’s lobbying to be extradited to the U.S. so he can be imprisoned here. Watt, who maintains that he was never fully aware of what Gonzalez wanted to use his software for, and who refused to give information on Gonzalez to the grand jury or prosecutors, was sentenced to two years.

According to Attorney General Eric Holder, who last month presented an award to Peretti and the prosecutors and Secret Service agents who brought Gonzalez down, Gonzalez cost TJX, Heartland and the other victimized companies more than $400 million in reimbursements and forensic and legal fees. At last count, at least 500 banks were affected by the Heartland breach. But the extent of the damage is unknown. “The majority of the stuff I hacked was never brought into public light,” Toey told me. One of the imprisoned hackers told me there “were major chains and big hacks that would dwarf TJX. I’m just waiting for them to indict us for the rest of them.” Online fraud is still rampant in the United States, but statistics show a major drop in 2009 from previous years, when Gonzalez was active
.