Hacker Gets 20-Year Prison Sentence for ID Theft from Retailers

One of the world’s most notorious computer hackers was sentenced to 20 years in prison Thursday after he pleaded guilty to helping run a global ring that stole tens of millions of payment card numbers.

Albert Gonzalez, a 28-year-old college dropout from Miami, had confessed to helping lead a ring that stole more than 40 million payment card numbers by breaking into retailers including TJX Cos Inc, BJ’s Wholesale Club Inc. and Barnes & Noble.

It was the harshest sentence ever handed down for a computer crime in an American court, said Mark Rasch, former head of the computer crimes unit at the U.S. Department of Justice.

Gonzalez and conspirators scattered across the globe caused some $200 million in damages to those businesses, said Assistant U.S. Attorney Stephen Heymann.

Heymann said it was not possible to quantify how much money was stolen from individuals. “They would quite literally go to ATMs and take out bundles of money from victims’ accounts,” Heymann told the court in Boston.

Under his plea agreement, Gonzalez had faced up to 25 years in prison, but asked the judge for leniency in sentencing, saying he had been addicted to computers since childhood, had abused alcohol and illegal drugs for years and suffered from symptoms of Asperger’s disorder, a form of autism.

“I stand before you humbled by the past 22 months sober,” he told U.S. District Court Judge Patti Saris with his parents and sister watching from the front row of a packed gallery.

Gonzalez, who buried $1 million cash in the backyard of his parents’ home, said that his crimes got out of control “because of my inability to stop my pursuit of curiosity and addiction.”

Heymann urged Saris to issue a stiff sentence, saying it would send a strong message to potential criminals that the government takes computer crimes seriously.

“He shook a portion of our financial system,” Heymann said. “What matters most is that teenagers and young adults not look up to Albert Gonzalez. They need to know that they will be caught. That they will be punished and that the punishment will be severe.”

In a statement, TJX said, “We are grateful that the investigation and prosecution of cyber crime continues to be a top priority of the U.S. Secret Service and Department of Justice,” and added that the number of retailers hit highlighted how widespread a problem hacking is.

Gonzalez’s prison term could be extended as another judge on Friday will sentence him on a second set of charges for which he has also pleaded guilty — stealing tens of millions more payment card numbers from companies including payment card processor Heartland Payment Systems, 7-Eleven Inc. and the Hannaford chain of New England grocery stores.

(Reporting by Jim Finkle, additional reporting by Phil Wahba in New York; Editing by Steve Orlofsky, Bernard Orr)