Albert Gonzalez and the store Wi-Fi that leaked millions of cards

The story

Albert Gonzalez had already been caught once, in a card fraud case in New Jersey, and avoided jail by helping the US Secret Service. While still working with them, he led a group that broke into the networks of retailers and payment processors.

Between 2005 and 2007, the group stole more than 170 million credit and debit card numbers. Victims included TJX, the parent company of TJ Maxx, as well as restaurant chains and the payment processor Heartland Payment Systems.

The group used a few methods. They looked for weaknesses in websites that let them reach the databases behind them, a technique called SQL injection. They also found stores whose wireless networks were poorly protected, connected from nearby, and worked their way into the systems that handled card payments. Once inside, they installed software that captured card data as it moved across the network.

Gonzalez was indicted in 2008 and 2009 and sentenced in 2010 to 20 years in federal prison.

Why it mattered

At the time, it was described as the biggest card fraud in history. It showed that a store’s poorly protected wireless network or a single flawed web page could lead straight to the systems that handle every customer’s card, and that a breach at a payment processor reaches far beyond one business.

The lesson today

The card data was taken from inside company networks, after the attackers got in through weak points like store Wi-Fi. Payment systems should sit on their own protected part of the network, with strong encryption on wireless and firewalls between the parts that do not need to talk to each other.