American Greed S05E40 Hackers Operation Get Rich or Die Tryin' HuluRIP ~IPASuperior

[MUSIC PLAYING]

NARRATOR (STACY KEACH): In
this episode of American Greed,

it's called Operation
Get Rich or Die Trying.

NEWS ANCHOR: The biggest
ID theft in US history.

NARRATOR: A mysterious
ring of social outcasts

with an insatiable
appetite for sex, drugs,

and your encrypted information.

CHRIS ROBERTS: There's
a very fine line

between exploiting a
system to check it out

or exploiting a system for gain.

PETER GANNON: They were
looking for data any way

they could get it.

NARRATOR: They steal
credit card numbers

and make a fortune by selling
them on the black market.

KIMBERLY KIEFER PERETTI: It
just kept building upon itself.

500,000 numbers, then
a million numbers,

up to 130 million numbers.

SABRINA RUBIN ERDELY: You or I
might be a victim of this crime

and we would never know.

NARRATOR: Victims lose millions,
but no one paid a greater price

than one of the gang's own.

SABRINA RUBIN ERDELY: He just
cracked under the pressure.

[MUSIC PLAYING]

NARRATOR: In May 2008,
federal agents in full SWAT

gear fan out across
South Florida.

They raid private homes,
condos, even a suite

at Miami's posh National Hotel.

PETER GANNON: We received
multiple search warrants

for numerous houses, cars,
for safety deposit boxes,

for servers, even
individuals in case

they had possessed thumb
drives or PDA in their pockets

or in their backpacks.

NARRATOR: Agents seized
more than a dozen computers

and obtained search warrants
for servers overseas.

On those servers,
they find millions

of credit card numbers.

KIMBERLY KIEFER
PERETTI: Their victims

were a whole range from
small banks and credit unions

to some of the
largest retailers,

well-known restaurant chains,
and some of the largest credit

card processors in
the United States.

NARRATOR: The
scheme's mastermind

is 26-year-old Albert Gonzalez.

SABRINA RUBIN ERDELY:
The problem with hackers

is that those who might
be inclined to try

to make some money
off of their skills

is that they don't know anything
about the criminal underworld,

and the criminal underworld
may not know that much about

hacking, but he could
bridge both worlds.

KIMBERLY KIEFER
PERETTI: I've always

thought of him as a forerunner,
sort of criminal industry

pioneer in this whole area

NARRATOR: For
Gonzalez, who also goes

by the handles soupnazi,
cumbajohnny, and segvec,

anonymity is key.

CHRIS ROBERTS: Most individuals
will have more than one handle.

So on one particular
forum, you'll

be known as a
certain individual,

on another forum you'll be
known as something else.

In some places,
you'll have a number.

It will be a sequence number
or a non-sequence number

depending upon
what you're doing.

PETER GANNON: These criminals
can communicate to one another

anonymously.

So a lot of times
the co-conspirators

may not know each
other in real life,

but they communicate
via instant messaging

and they can assist each
other in their crimes.

NARRATOR: But Gonzalez
is no ordinary criminal.

He'll soon be known as the
most cunning cyber crook

in American history.

Albert Gonzalez spends his
childhood in South Florida.

SABRINA RUBIN ERDELY: His
father came to America from Cuba

on a homemade raft in the
1970s, and they raised him

in a working class
neighborhood in Miami.

NARRATOR: Gonzalez
earns allowance

working for his father's
landscaping business.

SABRINA RUBIN ERDELY:
Albert grew up

in a very politically
conservative home,

church going Catholics in a
working class environment.

And he was a very sweet,
good natured boy, outgoing.

But all that changed when
Albert was about 12 years old

and he bought his
first computer.

NARRATOR: At first, his
hobby seems innocent enough.

SABRINA RUBIN ERDELY: He
just absolutely loved it.

He wanted to spend
all his time with it.

NARRATOR: But before long,
Gonzalez' fascination

with computers
becomes an obsession.

SABRINA RUBIN ERDELY: His
grades started dropping.

His mom begged him
to see a psychologist

and he absolutely refused.

NARRATOR: He falls in with
a group of hackers called

the Keebler Elves
Gang, and they hack

into NASA and the Indian
government's website.

SABRINA RUBIN ERDELY:
It was about being

able to pick those locks and
get those bragging rights.

To be able to say,
see, I did this.

I might just be a
teenager and I might

be powerless in the real world,
but online I'm like a god.

NARRATOR: After
graduating in 1999,

Gonzalez enrolls in
community college.

SABRINA RUBIN ERDELY:
Albert dropped out

of Miami Dade Community
College after less than a

semester and moved to
New York take a job

with a dot.com company, which
very quickly went under.

Then he took a job with
Siemens in their IT department,

but they very quickly
relocated to Pennsylvania

and he opted not
to move with them.

NARRATOR: Jobless, he
begins dabbling in drugs

and illegal online activity.

SABRINA RUBIN ERDELY:
He was in New York sort

of feeling like he
had hit rock bottom

and not really knowing
what his options were.

What he did know was that he
was really good at hacking

and he had access to this
internet carding forum

that he was well aware
of called ShadowCrew,

and that seemed like as
good a career option as any.

NARRATOR: In 2002, black
market carding websites

like ShadowCrew are
beginning to crop up.

PETER GANNON: You
go to these forums,

you can buy or sell credit
and debit card information.

You can buy access to retailers.

You can even hire people
to launder your money off

of these web pages.

KIMBERLY KIEFER PERETTI:
These carding forums

have no boundaries, and
criminals from every continent

join them and
participate in them.

NARRATOR: Using the
alias cumbajohnny,

Gonzalez quickly becomes a
ShadowCrew site administrator.

He helps crooks sell more
than a million stolen cards

for between $10 and $15 apiece.

CHRIS ROBERTS: It's millions.

I mean, we're not
talking about somebody

making a couple of thousand
or $5,000, $10,000, $15,000.

We're talking about millions
and millions of dollars.

KIMBERLY KIEFER PERETTI:
If they steal a debit card

number and a pin, then
they can re-encode

that on white plastic,
walk up to an ATM,

put the pin in, and
clean out the account.

NARRATOR: ShadowCrew members
call these cash out trips.

PETER GANNON: Once that ATM is
out, you go to the next one.

And you continue to
do that until you're

either out of cards or
the ATMs are out of money.

NARRATOR: It's a cash
out trip that would

be Gonzalez' unlikely downfall.

In 2003, New York
police officers

see a young man
loading card after card

into a nearby ATM machine.

During the arrest,
officers discovered

he is cyber criminal
Albert Gonzalez,

and they turn him over
to the Secret Service.

SABRINA RUBIN ERDELY:
The Secret Service

is responsible for
investigating cyber crime,

and they very quickly
recognized Albert's potential

in helping them to bust
other cyber criminals.

SETH KOSTO: There are places
that a cooperating defendant

in the cyber world can bring you
that you can't go on your own,

and that is the value
of working with them.

NARRATOR: The Secret Service
flips Gonzalez and pays him

$75 grand a year to help
with Operation Firewall.

KIMBERLY KIEFER
PERETTI: It wasn't as

if we were all sitting
around a table together

and he was sharing,
hearing, understanding

our strategies, our techniques.

His role was to continue
as administrator

of the site typing
on a computer,

communicating with
these individuals.

NARRATOR: The successful
undercover sting

nets 28 ShadowCrew members.

KIMBERLY KIEFER PERETTI: It
was a benchmark investigation,

benchmark prosecution,
and everything

was new every step of the way.

REPORTER: Authorities say
the thieves they arrested

had cost more than
$4 million in losses.

NARRATOR: After
Operation Firewall,

the Secret Service cuts Gonzalez
loose and he returns to Miami.

Once a hacker, always a hacker.

SABRINA RUBIN ERDELY: Legitimacy
for him was not really

an option at that point.

Because Albert
had gained so much

insight while
working for the Feds,

and he was not a person
to pass on an opportunity.

NARRATOR: Next on
American Greed,

Gonzalez forms his own gang
with a plan to make millions.

SABRINA RUBIN ERDELY: He
called it Operation Get

Rich or Die Trying.

It certainly was a
very ominous title,

and it certainly foreshadowed
what was to come.

[MUSIC PLAYING]

NARRATOR: Miami, Florida.

It's a playground for
the world's wealthiest

and for those
aspiring to have it

all, like 23-year-old
hacker, Albert Gonzalez.

In October 2004,
Gonzalez turns rat

and helps the Secret
Service bring down

ShadowCrew, the biggest
cyber crime bust to date.

But all the while,
he's plotting Operation

Get Rich or Die Trying.

SABRINA RUBIN
ERDELY: I think it's

safe to say the Secret Service
had no idea that Albert

was playing both sides.

That he was becoming a
master criminal while

at the same time working
as a snitch for them.

STEPHEN HEYMANN: His
overall business plan

was to break into a
series of major retailers,

obtain their credit and
debit card information,

and then either to
sell them or, in fact,

use other members of his
gang to cash them out.

To go to ATMs and use them
as essentially cows and milk

them till they were dry.

NARRATOR: Gonzalez enlist
the help of several hackers

he'd met online years before.

KIMBERLY KIEFER PERETTI:
They started off

as teenage friends trying
to get into government

sites, military sites,
and very quickly that

changed from hacking
for fun and curiosity

to hacking for profit.

STEPHEN HEYMANN: A number
of the collaborators

of Albert Gonzalez had
significant day jobs.

They were doing
security intrusion work

earning tens of thousands
or, at least one case,

in excess of $100,000
a year in salary.

NARRATOR: Stephen Watt,
Patrick Tooey, Chris Scott,

and Jonathan James become
Gonzalez' Hack Pack.

SABRINA RUBIN ERDELY: Stephen
Watt was a coding genius.

He graduated from
high school at 16.

He graduated from
college at age 19

and went on to take a job in
the IT Department of Morgan

Stanley, the Wall Street
investment banking

firm in Manhattan.

NARRATOR: Gonzalez meets Patrick
Tooey on a ShadowCrew cash

out trip in 2003.

SABRINA RUBIN ERDELY:
He came from a household

with a shifting
cast of characters

and had turned to hacking
as a way to kind of funnel

his alienation, his rage.

Patrick would do
anything that Albert

asked, from the coding to the
cash out trips and anything

in between.

He probably would have picked
up Alpert's dry cleaning

if he asked him to.

NARRATOR: Chris Scott
and Jonathan James

round out the gang.

SABRINA RUBIN
ERDELY: Chris Scott

was a depressed,
overweight geek from Miami

who had been ejected
from his high school

for disabling all of the
computers with a virus.

Chris' greatest
strength was probably

that he was best friends
with Jonathan James, who

was probably the most
famous hacker at the time.

He was very well known.

NARRATOR: At 16, Jonathan
James stakes his claim to fame

by serving six
months for hacking

into NASA and Defense
Department computers,

becoming the youngest
hacker ever sentenced.

Together, Gonzalez and his
crew become a tight knit band

of brothers.

STEPHEN HEYMANN:
These guys are driven

by a lot of the same things
that we're driven by.

They have an ego, they like
challenge, and, of course,

they like money and everything
you can get from money.

NARRATOR: Operation
Get Rich starts small

using a technique
called war driving.

CHRIS ROBERTS: So
we've just gone

by a really nice place that
was not very well encrypted.

NARRATOR: Chris
Roberts is a gray hat

hacker, an internet security
expert specializing in fraud.

CHRIS ROBERTS: As we're
driving along here,

we're still pulling in
a lot of wireless access

points, a lot of systems.

Some are encrypted, some
aren't very well encrypted.

And we've pulled in 800 access
points and almost 500 computers

and systems that are
attached to them.

NARRATOR: Like
Roberts, the Hack Pack

uses a Wi-Fi antenna to find
unencrypted or vulnerable

networks.

CHRIS ROBERTS: We're
able to just listen

in and see what kind of wireless
systems are advertising.

No different than a radio.

As you drive along with a
radio, you go in and out

of signal strengths.

This is basically
the same thing.

NARRATOR: Chris Scott
and Jonathan James

tune into one store at a
time along US-1 in Miami.

CHRIS ROBERTS:
They'll have pulled

into every single one of these
retail areas, slowly driven

through to see what wireless
access points were advertising,

and to see which
ones were encrypted

or which ones were
not encrypted.

SABRINA RUBIN
ERDELY: The first one

that they found was a BJ's
Wholesale Club where they

parked outside and downloaded
all of the credit and debit

card numbers as they were
being swiped by the customers.

NARRATOR: Gonzalez
forwards thousands

of card numbers to Patrick
Tooey and other associates.

CHRIS ROBERTS: So at
that point in time,

you need a little device, which
is a card reader and a writer,

and you'll also need
some blank credit cards.

NARRATOR: They then encode
the information onto blanks,

and runners cashed
them out at ATMs.

Gonzalez, who was
raised a Catholic,

feels a slight twinge of guilt.

SABRINA RUBIN ERDELY:
He told Patrick,

we're going to hell for
this, and he really meant it.

But he made himself feel
better by telling himself

that once the
fraud was detected,

then the credit card companies
would restore people's money

and all would be fine.

NARRATOR: But war driving
and cashing out is risky.

CHRIS ROBERTS: I physically
have to put myself in a position

where I might be videotaped.

I might be caught on
a surveillance camera.

Somebody might be clever
enough to work out

that these stores
are getting hit.

STEPHEN HEYMANN:
Albert Gonzalez himself

had learned that cashing out
was a dangerous mechanism

because he himself had been
arrested while cashing out.

NARRATOR: Gonzalez knows
there's a better way

to generate higher volume
with less exposure.

KIMBERLY KIEFER PERETTI: He's
associating with elite carders

and hackers in Eastern
Europe and other places,

so he's trying to
refine his techniques

and make them even
better and less risky.

NARRATOR: To do
this, Gonzalez needs

a program called a sniffer
code, which he lacks

the technical skills to write.

CHRIS ROBERTS: That
program then, on its own,

will look around your computer.

It will look around
for your social,

it will look around
for your credit cards,

it will look around for
your banking information.

Basically whatever I've
programmed it to do.

And then it will call
back to me and say,

here's all your information.

Have a nice day.

NARRATOR: Gonzalez
calls on Stephen Watt,

who fires off the code in
10 hours, free of charge.

SABRINA RUBIN ERDELY:
And it was really

the key to this being the
cyber crime of the century.

NARRATOR: Once the
sniffer code is installed,

they can access, copy, and
download data remotely,

and it starts to pour in.

CHRIS ROBERTS:
Obviously, when you're

attacking a system, when
you're gathering data,

you need somewhere to
put this information.

You're not going to want to
put it right on your computer

because if your computer gets
lost, stolen, taken, or seized,

you just handed somebody
a huge amount of evidence.

NARRATOR: Gonzalez needs a
safe place to stash the data.

SABRINA RUBIN
ERDELY: Patrick Tooey

had set up servers in Latvia,
Singapore, China, and Ukraine

to store all of these reams
and reams, mountains of data.

NARRATOR: But in storage, the
numbers near their expiration

dates and they
diminish in value,

so he calls on an
international crime lord

to expedite distribution.

PETER GANNON: Maksym Yastremskiy
is the Ukrainian national

who was the biggest wholesaler
of credit and debit cards

around the world.

NARRATOR: Yastremskiy
sells the card numbers

for between $150 and $300 a pop,
of which Gonzalez takes half.

PETER GANNON: Yastremskiy
would sell those cards

via the internet
or in these carding

forms or portals to
other lower level sales

people, who would then turn
around and sell them again.

NARRATOR: Yastremskiy
Distributes the profits

to Gonzalez through
online currency exchanges.

Soon, packages
containing up to $370,000

are piling up at
Gonzalez' dropbox.

SABRINA RUBIN
ERDELY: He actually

complained to Stephen Watt that
once his money counter broke

from overuse, and he complained
that he had to count, manually,

$340,000.

NARRATOR: By the summer
of 2005, Gonzalez

begins to indulge in his new
lifestyle as a mini mogul.

SABRINA RUBIN ERDELY: It
was completely over-the-top.

I would say much of the
profits from Operation Get Rich

or Die Trying went
right up their noses.

NARRATOR: Gonzalez and his
crew book a $5,000 a night

suite at the Loews
Hotel in South Beach.

SABRINA RUBIN ERDELY:
When they were in Miami,

they would make this
insane concoction called

a magic milkshake, which was
cookies and cream Haagen-Dazs

ice cream, skim milk,
magic mushrooms, LSD,

and ecstasy all blended
together to create

just the most extreme,
insane experience ever.

NARRATOR: Gonzalez also throws
himself an extravagant party

to celebrate his birthday
in New York City.

SABRINA RUBIN ERDELY:
They would lay out a drug

buffet on the coffee table.

So C for coke, E for ecstasy.

They had the best champagne,
they had the best designer

drugs, they had the most
beautiful women there.

It was like life as
they would design it.

NARRATOR: Despite this
drug fueled lifestyle,

Gonzalez never loses
control of his business.

SABRINA RUBIN ERDELY:
He was always reachable.

He slept with his
laptop next to him.

He brought his laptop with
him on vacation, to the gym.

He always had it with him.

NARRATOR: Next on American
Greed, Operation Get Rich

or Die Trying gets
more sophisticated

and the hackers up the ante.

SABRINA RUBIN ERDELY: The
idea that these guys were

able to slip past all of these
levels of internet security

was just incredible.

NARRATOR: And the hackers
take one company to the brink.

BOB CARR: What do
you do when you're

facing the worst
possible thing that

can happen to your company?

[MUSIC PLAYING]

NARRATOR: By 2005, Albert
Gonzalez and his crew

had successfully hacked into
several retailers along US-1

in South Florida.

These big box stores send data
to corporate servers, which

Gonzalez knows is
the real gold mine.

CHRIS ROBERTS: It's very
much a case of well, hang on.

If I can do it to these couple
of individuals in a store

or if I can do it to
these couple of stores,

can I do it to more stores?

Can I do it to a
series of stores?

Can I do it to a bigger store?

And then you go to,
can I actually get

the core centralized system?

And then it's like, wow, OK.

If I can get the core system,
who processes all the data?

I can go for the mother
lode at that point.

NARRATOR: He orders his crew
to perform reconnaissance

on potential targets.

STEPHEN HEYMANN: They identified
them in a variety of ways.

Christopher Scott simply
going up and down Route 1

with his computer, seeing where
there were vulnerable access

points.

Going down the list of
Fortune 500 companies,

identifying companies that
shared a common credit card

processing system, or
identifying ones that

had vulnerable payment systems.

PETER GANNON: So walk in,
maybe make a purchase,

or just walk in and look to see
what point of sales terminal

the stores were using so
they could reverse engineer

how to break in to
the corporate networks

through these different
point of sales terminals.

NARRATOR: That July,
they hit TJX Companies,

the publicly traded parent
of Marshalls and TJ Maxx.

STEPHEN HEYMANN:
Christopher Scott

breaks into two vulnerable
wireless access points

at two Marshall's stores
along Route 1 in Florida.

Within a matter of weeks,
he's able to move from there

into one of the major payment
card processing servers

that TJX is using.

CHRIS ROBERTS: You have
access, at that point in time,

to the corporate site.

Because now you have
all of these stores

are sending their daily, weekly,
monthly batches all the way up

to the corporate location.

NARRATOR: Chris Scott,
Gonzalez' foot soldier,

explores the network.

STEPHEN HEYMANN: He gets
increasing amounts of rights

or privileges to move
around the system

and discovers a storage
location that has 40 or 50

million payment card numbers.

NARRATOR: They download
that batch of data,

but Gonzalez isn't satisfied.

He wants access to all the
numbers coming in to TJX,

not just the numbers
in the storage.

In May 2006, Chris Scott
installs and configures

a VPN, or virtual
Private Network.

SABRINA RUBIN
ERDELY: Albert's crew

had set up a virtual
private network, which

is a secure connection
between TJX's server

and one of Albert's servers.

So whenever they wanted to,
they could just tap that keg,

open up the connection, and
let the data stream from

TJX's server right
onto Albert's.

NARRATOR: Scott then
installs a sniffer code,

the program that copies numbers
while they're being processed.

STEPHEN HEYMANN: It
turns out that there's

a very tiny window of time
when the credit and debit card

numbers aren't being
encrypted, when

it happens to be in the open
as it's being processed,

and it's during that period
that they make a photocopy of it

all for themselves.

NARRATOR: Using the
handle 201679996,

Gonzalez instant messages
Maksym Yastremskiy,

his Ukrainian partner in crime.

In that chat, he mentions
the sniffer code.

Soon Yastremskiy could
expect more data.

Business is booming
for Gonzalez,

whose crew downloads
more than 45 million card

numbers through December 2006.

SABRINA RUBIN ERDELY:
If you shopped

at any of these retail stores
during that period of time,

there's a very good chance
that your credit card or debit

card was compromised.

NARRATOR: That Christmas, more
than 18 months after Gonzalez'

crew first hit TJX, the retail
giant detects suspicious

software on its systems.

Alarm bells sound, and the
Feds begin to investigate.

KIMBERLY KIEFER
PERETTI: We didn't

know if it was
one individual, it

was several different groups
doing these compromises.

STEPHEN HEYMANN: What did
we know from the forensics

as to where it was going?

Did it look like anybody
else that we'd ever seen?

All of these things were being
carefully followed out wholly,

I'm embarrassed to
say, unsuccessfully.

NARRATOR: By January
2007, Gonzalez

has pulled in more than 45
million credit and debit card

numbers from TJX and
he decides to get out

of the corporate system,
but trouble is beginning

to brew half a world away.

STEPHEN HEYMANN:
The Secret Service

had been conducting a totally
separate and totally unrelated

investigation into
Maksym Yastremskiy

for his international sale of
credit and debit card numbers.

NARRATOR: Turkish authorities
arrest Maksym Yastremskiy

that July.

STEPHEN HEYMANN: That
leads to the seizure

of a laptop computer, which
the Turks provide to the Secret

Service.

SABRINA RUBIN ERDELY: When
they opened up this computer,

they found all kinds of
things, including lots of chat

logs with an American who
went by an obscure string

of numbers.

STEPHEN HEYMANN: 201679996 is
passing on a piece of software

and says it's one that I
modified for use in TJX.

And that starts the
investigation of who 201 is

and how Maksym
Yastremskiy relates to TJX

and to other investigations.

NARRATOR: They
find further chats

about a breach of
Dave and Busters,

the entertainment chain.

PETER GANNON: Maksym
Yastremskiy said

he had another hacker who
was into a company named

D&B in the United States.

NARRATOR: Yastremskiy
had asked 201

to provide a sniffer code to
capture Dave and Busters credit

card data.

PETER GANNON: That sniffer
program with the same sniffer

that was utilized
in the TJX hacks,

so that was our first
clue that 20167996 may

have been involved with TJX.

NARRATOR: The Feds follow
these leads for months, just

as Gonzalez heads into the final
phase of Operation Get Rich.

With Yastremskiy
behind bars, Gonzalez

decides to keep a closer
eye on his associates,

especially Patrick Tooey,
his right hand man.

SABRINA RUBIN ERDELY: It
was more important than ever

that he exert as much
control as possible

over all of the variables.

NARRATOR: In August,
Gonzalez moves Tooey

into his Miami condo.

It's a far cry from
the hotel suites

they've partied in before.

SABRINA RUBIN ERDELY:
It was a dump.

In part, it was because he
wanted to live under the radar,

because he understood from his
experience with law enforcement

that spending money is one of
those things that gives you

away.

KIMBERLY KIEFER
PERETTI: It's different,

though, from some
of the hackers we've

seen in Eastern Europe where
they'll buy a restaurant,

they'll buy a housing
project or complex, they'll

buy million dollar apartments.

That wasn't this crew here.

They might buy a
few nice computers

or recreational
items, but they're not

living in the million dollar
apartments in Manhattan.

NARRATOR: By late
fall, operation

get rich progresses from war
driving to more complicated web

based hacks.

Gonzalez conspires with
Tooey and two Russians

to commit a series of
other intrusions using

a diabolical plan known
as a SQL injection attack.

KIMBERLY KIEFER PERETTI:
A SQL injection attack

is an internet based attack on a
website that's database driven.

So the most important
difference is

you don't need that
physical proximity anymore

to conduct these types of
remote hacks into systems.

You can be sitting in India
and do a SQL injection

internet based attack on a
computer system in California.

NARRATOR: Coming up, Gonzalez
and his co-conspirators

go to the mother lode and
target a credit card processing

company, their
biggest prize yet.

STEPHEN HEYMANN: They
were in a position

to access tens of millions of
payment card numbers quickly,

and that was a golden goose.

CHRIS ROBERTS: To the hackers,
the credit card processing

company, it's like the holy
grail at that point in time.

[MUSIC PLAYING]

NARRATOR: By December 2007,
Operation Get Rich or Die

Trying has entered its
most ambitious phase yet.

Albert Gonzalez and
his conspirators

target several companies,
including Heartland Payment

Systems, one of the world's
largest payment processors.

BOB CARR: We process for about
250,000 locations in America

and a few in Canada,
and we process about 4

billion transactions a year.

NARRATOR: Bob Carr is
the founder, chairman,

and chief executive officer
of Heartland Payment Systems.

BOB CARR: There's
no doubt that people

who process billions
of transactions

are the mother lode of data.

That's for sure.

When we were doing our
initial public offering

in stock on the road show,
the question everyone

asked is, what keeps
you awake at night?

And my answer was
always getting breached.

NARRATOR: But Carr
is totally unaware

that his worst nightmare
is coming true.

Gonzalez and Patrick Tooey
invisibly hack into Heartland

using a SQL injection attack.

RICHARD WANG: If I were to
walk up to you on the street

and say, can you
tell me the time?

You'd tell me the time.

But if I were to walk up to
you on the street and say,

can you tell me your name,
address, social security

number, and mother's
maiden name?

Then you're not
going to do that.

You're smart enough to know the
difference between information

you should give
out and information

you shouldn't give out.

Whereas with a website that's
subjected to a SQL injection

attack, it's not programmed
to correctly recognize

which commands it
should obey and which

commands it should ignore.

NARRATOR: They install a
sniffer code to copy data

in small, well-timed chunks.

SETH KOSTO: From
there, it was a matter

of having that sniffing software
work and send the payment card

information, the credit and
debit card information out

to hacking platforms
in foreign countries

and in the United States
that could be used to receive

and store the card
data that was stolen,

but also the malware,
the software that

was used to sell it.

NARRATOR: For
months, the hackers

tap into Heartland's network.

CHRIS ROBERTS: You
don't want to turn

the spigot on the
whole way and just

drain the thing immediately.

You want to take a little bit
at a time and keep on taking it.

NARRATOR: They access more
than 130 million credit

and debit card numbers.

BOB CARR: These bad guys spent
hours and hours and hours

for months and months
and months trying

to figure out and
customize an attack that

would get through and get
into our payments network,

and they were able to do that.

NARRATOR: Back at
the Secret Service,

agents have been combing through
Maksym Yastremskiy's computer,

They find chats referring to
someone with the initials CJ.

KIMBERLY KIEFER PERETTI: CJ
Is short for cumbajohnny,

which is the name
we had Gonzalez

use when he was an informant
in Operation Firewall.

It's a very small connection
very much at the periphery,

but we had one or two of
those little indications start

to unravel.

NARRATOR: They also
learned the Ukrainian crime

lord has been chatting with a
mysterious American, 201679996,

who was somehow involved
in the TJX hack.

STEPHEN HEYMANN: 201679996 is
connected to an email address,

[e-mail],
and the Secret Service

recognizes that
email address as one

that has been used previously
by Albert Gonzalez.

For the first time,
there was a major lead.

NARRATOR: Shock waves rippled
through the Secret Service.

Is Gonzalez playing both sides?

SABRINA RUBIN ERDELY: While
Albert is masterminding

this incredible cyber
crime, he is still working

as an informant for the Feds.

NARRATOR: Agents moved quickly
to secure warrants to arrest

Gonzalez and his crew.

And by now, Gonzalez knows
the heat is coming down.

KIMBERLY KIEFER PERETTI: When
you were involved with someone

that gets arrested, you're
going to be more apprehensive,

and we had seen in the
chats that 201 person being

apprehensive about
that situation.

So he most likely knew from
reading public information

about our cases, hearing
things, that we were closing in.

NARRATOR: On May 7, 2008,
after nearly a year long

investigation, the Feds
go after their informant.

KIMBERLY KIEFER PERETTI:
These young kids had access

to documents that would allow
them to immediately flee

the country, and we were very,
very concerned that Gonzalez

was going to be one of those.

And once he was gone, we
would never get him back.

NARRATOR: About 150 agents
scour Gonzalez' condo,

his parents' house, and
several other residences.

PETER GANNON: From
Gonzalez' condominium,

there was multiple computers
and media that was seized,

a large quantity of cash.

At Gonzalez' parents'
residence, we

see a number of computers,
documents, a money counter.

NARRATOR: But Gonzalez
is nowhere to be found.

KIMBERLY KIEFER PERETTI: When
they arrived at the place where

they thought Albert
Gonzalez would be,

at his parents' house or
his girlfriend's house,

he was neither, and that's
when the panic began.

NARRATOR: On a tip, they search
a suite at the National Hotel

in Miami's South Beach, where
they find Gonzalez along

with two laptops, $22,000 in
cash, and a Glock 27 handgun.

They arrest Gonzalez
and Christopher Scott

that same day.

Patrick Tooey is
arrested soon after.

SABRINA RUBIN ERDELY:
Patrick knew he was sunk.

He knew that he and
the entire operation,

they were just dead meat.

He started talking immediately.

After Albert discovered that
Patrick was cooperating,

Albert himself became
very cooperative

and he led them to a lot of
information, including he

told them where the
money was buried

in his parents' backyard.

NARRATOR: Investigators returned
to Albert's childhood home,

where they searched the yard.

They find a barrel buried
beneath a palm tree.

PETER GANNON: Once the
earth was unsealed,

inside was over $1 million
of vacuum packed cash.

NARRATOR: Gonzalez has stashed
$1.1 million in plastic bags

for safe keeping.

Soon, the Feds unearth more
secrets about the case.

KIMBERLY KIEFER PERETTI: When we
executed those search warrants,

one of the individuals
spoke and said

that Albert Gonzalez
used the nickname segvec,

and that was the evidence
we were looking for

to get us over the edge
and be able to indict him.

NARRATOR: Segvec,
the handle Gonzalez

used during chats
with Yastremskiy

about Dave and Busters,
clinches it for the Feds.

KIMBERLY KIEFER PERETTI:
Finally, really, we're

starting to unravel and
understand all these data

breaches we had seen
happen over the years.

It was really exciting.

It was shocking.

NARRATOR: A few weeks later,
the criminal complaint

against Gonzalez
is posted online,

and it rocks the
hacking underworld.

SABRINA RUBIN ERDELY: This
is a very close community

of hackers.

These are people,
you have to remember,

who are very alienated
from the rest of society.

They feel that all they
have is each other.

NARRATOR: 24-year-old
Jonathan James, Gonzalez'

former war driver,
is shocked to learn

that his boss has been
working for the Secret Service

since 2003.

CHRIS ROBERTS: There's just been
this nice set of cliquey groups

and you can trust everybody.

And now you're like, well,
whose side are you on?

NARRATOR: James, who had become
famous for hacking as a teen,

believes his friends
will rat him out.

Coming up, James taking
matters into his own hands

and Operation Get Rich or Die
Trying takes a deadly turn.

SABRINA RUBIN ERDELY:
He did not want

to have that kind of
heat on him again.

And the idea that they were
now turning on each other, that

was intolerable to him.

[MUSIC PLAYING]

NARRATOR: In May 2008,
with Albert Gonzalez

and his Hack Pack
behind bars, the Feds

work to shore up their case.

But Jonathan James, one
of Gonzalez' war drivers,

is still free, and he
jumps to the conclusion

that Gonzalez is
going to set him up.

SABRINA RUBIN ERDELY:
He said that he was sure

that he was going to be the
scapegoat for this crime given

his notoriety and also given
that he knew that Albert was

a government cooperator,
and he was sure

that Albert was going
to pin the crime on him.

NARRATOR: James pens a
letter titled "Story Time."

In it, he says he had
nothing to do with the hack.

SABRINA RUBIN ERDELY: He
couldn't bear the idea

that they were all
betraying each other.

Once these hackers turn on each
other, they had nobody left.

NARRATOR: Remember, it's
not whether you win or lose,

it's whether I win or
lose, and sitting in jail

for 20, 10, or even 5 years
for a crime I didn't commit

is not me winning.

I die free.

Minutes later, he
picks up a handgun,

points it to his temple,
and pulls the trigger.

SABRINA RUBIN ERDELY: If
he, in fact, played a part

in this crime, he played
a very small part,

and it's not clear whether
he would have been indicted

had he not killed himself.

NARRATOR: The Feds
filed more indictments

against Gonzalez and
his crew in August 2008.

And for the first time,
the scope of the crime

becomes clear.

KIMBERLY KIEFER
PERETTI: We had to keep

replacing our press
releases of this

is the most significant,
largest data breach we've had.

It just kept
building upon itself.

500,000 numbers, then
a million numbers.

NARRATOR: The
first indictment is

filed in New York for the
Dave and Buster's breach,

the second in Massachusetts
for the hacks into TJX

Companies, BJ's Wholesale
Club, OfficeMax,

and several other businesses.

But despite being
in jail, Gonzalez

is still wreaking
havoc on the outside.

In October 2008,
credit card companies

warn Heartland Payment Systems
of suspicious activity.

BOB CARR: We hired
forensics companies

to help try to find it.

We got reports that there
were no problems found,

so we thought we
were in the clear.

When forensics
companies tell you

that they can't find anything
and they do this for a living,

you get some sense of comfort
that there's not a problem.

NARRATOR: Three months go
by, and in January 2009,

Heartland chiefs get the
call they've been dreading.

BOB CARR: Someone had found
data in our system that

could not be explained.

Data that we did not create.

In the next couple of days, we
learned that there was malware

that was creating this
data, and that turned out

to be the card numbers.

They were put into files
that were compressed.

I knew it would be disastrous
for a lot of the stockholders

of the company, including me.

NARRATOR: Heartland goes public
with news of the breach days

later.

NEWS ANCHOR: Another
big story at 6.

A credit card processing
company gets hacked into.

NARRATOR: The company's stock
plummets from about $16 a share

to less than $4, but the
loss is really much greater.

We've reported losses
of $139 million

that we've paid out or
booked that we will pay out.

So we suffered a net
$110 million dollar loss

and we still don't
know if we're finished.

We probably are not, but
we think the bulk of it

is behind us.

NEWS ANCHOR: In Focus
this evening, security

in cyberspace.

RICHARD WANG: A lot of people
will look at Heartland,

and they don't want to be
the next headline on CNBC,

so they're going to be
quite careful to improve

the standards and make sure that
they're defending themselves.

NARRATOR: In August 2009,
Gonzalez, Patrick Tooey,

and two unnamed
Russian hackers are

indicted in New
Jersey for conspiring

to break into Heartland and
several other companies.

SETH KOSTO: Software has sort
of a digital fingerprint,

a kind of digital DNA.

And in the process
of investigating it,

if it has that same DNA,
there's a link between those two

victims sites.

And what we ended up with
was enough similarities

between the five victim
sites to know that we were

working with one hacking crew.

NARRATOR: But much
about the case

remains a mystery, like
how many credit card

numbers were stolen.

STEPHEN HEYMANN: There
were tens of millions

more at TJX and in excess
of 100 million at Heartland

that could have been taken, but
nobody knows the exact number.

NARRATOR: And how
much money Gonzalez

and his crew ultimately
earned from their hacks.

KIMBERLY KIEFER PERETTI:
They're young kids.

They spent a lot of money.

They spent a lot of money
on partying, a lot of money

on drugs.

Fun nights out spending $80,000.

So it's hard for us to
know if they didn't just

spend most of it too.

NARRATOR: Prosecutors do know
that victims lose at least $400

million, and restitution
is set at $172 million.

STEPHEN HEYMANN: Gonzalez, with
his team, committed the largest

identity theft ever
prosecuted in the United

States, and perhaps the world.

The dollar loss was
so large that it

changed the behavior
of corporations

as they realized that
they had to increase

the level of security because
there was a large dollar

risk involved.

So it was changing
to the whole culture

in the size of what he did.

NARRATOR: Patrick Tooey,
Stephen Watt, Chris Scott,

a Maksym Yastremskiy all serve
multi-year sentences in prison.

And as for Gonzalez--

STEPHEN HEYMANN: He agreed to
plead guilty to all of them,

and ultimately received
a 20 year sentence

to run on each of them at
the same time, restitution

well in excess of $100 million,
and forfeiture of jewelry,

computers, and over
$1 million in cash

that had been dug up in
his parent's backyard.

NARRATOR: At sentencing,
Gonzalez' attorney

argues these were
not crimes of greed,

rather that Gonzalez suffers
from Asperger's syndrome,

a mild form of autism,
which could explain

his addiction to computers.

SABRINA RUBIN ERDELY:
People with Asperger's are

unable to relate
to other people,

whereas Albert was
a natural leader.

He, by definition, could
relate to other people,

size them up, negotiate with
them, squeeze work product out

of them.

He was the exact opposite
of somebody with Asperger's.

NARRATOR: Court appointed
psychologists find

no evidence of the disorder.

STEPHEN HEYMANN: These
guys spent a lot of time

on their computers, but
so does about 1/2 to 2/3

of all the students
at nearby MIT.

So the fact that you
spend a lot of time

on your computer as a
kid, that you communicate

with others on your computers,
does not justify crime.

NARRATOR: In the
end, what begins

as teenagers hacking
for fun, soon

becomes the
costliest cyber crime

in history, an operation
that lives up to its name.

SABRINA RUBIN ERDELY: When
Albert called this caper

Operation Get Rich
or Die Trying,

I'm sure he didn't actually
intend for anyone to die.

[MUSIC PLAYING]