Loading story…
Albert Gonzalez, known online as SoupNazi, was sentenced to 20 years in prison for leading a hacking ring behind some of the largest payment card breaches prosecuted in the United States. U.S. authorities said Gonzalez and his co-conspirators infiltrated major retailers and payment processors including TJX, BJ’s Wholesale Club, OfficeMax, Barnes & Noble, Sports Authority, Dave & Buster’s, 7-Eleven, Hannaford Brothers, and Heartland Payment Systems, stealing tens of millions of credit and debit card numbers and causing losses estimated at nearly $200 million, with broader economic damage potentially reaching into the billions.
Court records said the group used wardriving to find vulnerable wireless networks, deployed sniffers and Trojan malware to capture payment card data, and moved stolen information through anonymous online currencies and bank accounts in Eastern Europe. The Justice Department described the operation as the largest hacking and identity theft ring then prosecuted by the U.S. government, involving accomplices in the United States, Estonia, Ukraine, and Turkey, affecting more than 250 financial institutions, and resulting in multiple guilty pleas, extraditions, and related convictions tied to the sale and fraudulent use of more than 40 million stolen card numbers.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
Court documents said Albert Gonzalez and co-conspirators infiltrated U.S. retail networks and payment processors using wardriving, sniffer programs, and malware, stealing more than 40 million payment card numbers and affecting more than 250 financial institutions. The stolen data was sold for fraudulent use, used in ATM cash-out fraud, and laundered through anonymous internet-based currencies and Eastern European bank accounts.
On 2010-03-26, Albert Gonzalez was sentenced for his lead role in massive payment card data thefts tied to major retailers and Heartland Payment Systems. The sentence was described as 20 years in prison, with the Justice Department specifying concurrent terms of 20 years and 20 years and one day.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
justice.gov
Open sourceabcnews.com
Open sourcestarnewsonline.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch courts cleared the extradition of Russian national **Vladimir Drinkman** to the United States in a case prosecutors described as the largest hacking and data-breach conspiracy ever prosecuted there. U.S. authorities alleged Drinkman and four co-defendants used **SQL injection**, malware backdoors, and network sniffers to penetrate payment processors, retailers, and financial institutions, stealing more than **160 million** credit and debit card numbers over several years and causing hundreds of millions of dollars in losses. Victims named in court filings included **Heartland Payment Systems**, **7-Eleven**, **Hannaford**, **Carrefour**, **JetBlue**, **Global Payments**, **Dow Jones**, and **NASDAQ**, though prosecutors said the NASDAQ intrusion did not affect its trading platform. The prosecution tied the operation to the broader payment-card theft ecosystem exposed in earlier cases involving **Albert Gonzalez**, who had already been accused of orchestrating some of the largest U.S. retail breaches. After his transfer to the United States, Drinkman later admitted his role in the conspiracy, marking a major step in a long-running investigation into an international crew that allegedly harvested card data from corporate networks and sold it through criminal resellers. The case underscored how a small group of Russian and Eastern European defendants allegedly sustained long-term access inside major companies and monetized stolen payment data at unprecedented scale.
Jun 29, 2026
Nathan Austad, a 21-year-old Minnesota man who used the alias **"Snoopy"**, was sentenced to 18 months in prison for his role in the 2022 credential-stuffing attack that compromised DraftKings customer accounts. U.S. prosecutors said Austad pleaded guilty to conspiracy to commit computer intrusion and admitted participating in a scheme that used usernames and passwords from other breaches to access DraftKings accounts protected by weak or reused credentials. He was also sentenced to three years of supervised release and ordered to pay roughly **$1.8 million** in restitution and forfeiture. Authorities said the group compromised about **60,000** accounts, while DraftKings previously disclosed that **67,995** customer accounts were affected. The attackers added payment methods they controlled to roughly **1,600** accounts, stole about **$600,000**, and sold access to compromised accounts through online marketplaces including **Goat Shop** and Austad’s own Snoopy-branded site. Investigators also traced about **$465,000** in cryptocurrency tied to Austad, and his sentencing makes him the third defendant convicted in the case after Joseph Garrison and Kamerin Stokes received prison terms.
Jun 29, 2026
Former AT&T retail employee Kenneth Carter of Portland, Oregon, received a 16-month federal prison sentence for using authorized store-system access to conduct SIM swaps for cybercriminals between May 2018 and November 2019. Carter transferred victims' phone numbers to SIM cards controlled by himself or co-conspirators, allowing them to reset account passwords and intercept SMS-based multifactor authentication codes tied to online banking accounts. The conspiracy attempted to steal **$593,963.77** from three victims. Fraud controls stopped two attempted bank transfers of roughly $247,000 each, but a third victim lost **$99,528.33**; a 2019 search of Carter's home also recovered victims' sensitive data, including Social Security numbers. The case illustrates the risk of insider-enabled SIM swapping and reliance on SMS-based authentication for high-value financial accounts.
Sep 15, 2026