Fatal System Error: The Hunt for the New Crime Lords Who Are Bringing Down the Internet

by Joseph Menn

That, sadly, is not the worst of it. Hacker CumbaJohnny had been helping run Shadowcrew, while his real-life alter ego, Albert Gonzalez, was helping the Secret Service track what happened there. But the same man had a third identity, “Segvec.” Federal agents knew Segvec was bad, they just didn’t know he was one of their own. In filings against e-Gold, they described customer Segvec as a known Ukrainian carder. In reality, the Secret Service later admitted, Segvec was the young Cuban American who had been aiding their Shadowcrew probe since 2003. All the while, Gonzalez and two young men in Miami had been “wardriving”—driving up and down outside major businesses seeking wireless vulnerabilities to tap into. They hacked into OfficeMax, BJ’s Wholesale Club, and Barnes & Noble. They hit the mother lode in July 2005, when they got into the network at a Marshall’s department store and installed a “sniffer” on the computers of parent company TJX, which also owned the T.J. Maxx chain. All told, they sucked down as many as 45 million credit and debit card numbers, about twenty times what Shadowcrew members were accused of trafficking. TJX racked up more than $100 million in expenses to settle litigation and belatedly improve its security. In terms of the hundreds of breaches publicly reported since ChoicePoint, “T.J. Maxx is kind of the grand-daddy of them all,” said an executive of a top encryption firm.