VIETNAMESE NATIONAL SENT TO PRISON FOR ROLE IN INTERNATIONAL HACKING AND IDENTITY THEFT SCHEME

FROM:  U.S. JUSTICE DEPARTMENT 

Tuesday, July 14, 2015

Vietnamese National Sentenced to 13 Years in Prison for Operating a Massive International Hacking and Identity Theft Scheme

A Vietnamese national was sentenced to 13 years in prison for hacking into U.S. businesses’ computers, stealing personally identifiably information (PII), and selling to other cybercriminals his fraudulently-obtained access to PII belonging to approximately 200 million U.S. citizens.

Assistant Attorney General Leslie R. Caldwell of the Justice Department’s Criminal Division, Acting U.S. Attorney Donald Feith of the District of New Hampshire and Director Joseph P. Clancy of the U.S. Secret Service made the announcement.

Hieu Minh Ngo, 25, was sentenced today by U.S. District Court Judge Paul J. Barbadoro of the District of New Hampshire.  Ngo previously pleaded guilty to federal charges brought in the District of New Hampshire and the District of New Jersey, including wire fraud, identity fraud, access device fraud and four counts of computer fraud and abuse.

“From his home in Vietnam, Ngo used Internet marketplaces to offer for sale millions of stolen identities of U.S. citizens to more than a thousand cyber criminals scattered throughout the world,” said Assistant Attorney General Caldwell.  “Criminals buy and sell stolen identity information because they see it as a low-risk, high-reward proposition.  Identifying and prosecuting cybercriminals like Ngo is one of the ways we're working to change that cost-benefit analysis.”

“This case demonstrates that identity theft is a worldwide threat that has the potential to touch every one of us,” said Acting U.S. Attorney Feith.  “I want to acknowledge the excellent work of the United States Secret Service in identifying and capturing Mr. Ngo.  This case proves that the United States Attorney’s Office for the District of New Hampshire will work with law enforcement to investigate and prosecute identity thieves, even if they are halfway around the world.”

“The sentencing of this transnational cybercriminal illustrates another example of Secret Service success in the disruption and dismantling of global criminal networks,” said Director Clancy.  “This investigation and the resulting prosecution and sentencing should serve as a warning to criminals that we will relentlessly investigate, detect, and defend the Nation’s financial infrastructure.  This sentencing joins a long list of successes in combating financial crimes over our 150 year history.”

According to admissions made in connection with his guilty plea, from 2007 to 2013, Ngo operated online marketplaces from his home in Vietnam, including “superget.info” and “findget.me,” to sell packages of stolen PII.  These packages, known as “fullz,” typically included a person’s name, date of birth, social security number, bank account number and bank routing number.  Ngo also admitted to acquiring and offering for sale stolen payment card data, which typically included the victim’s payment card number, expiration date, CVV number, name, address and phone number.  Ngo admitted that he obtained some of the stolen PII by hacking into a New Jersey-based business and stealing customer information.

In addition to selling the “fullz,” Ngo admitted to offering buyers the ability to query online databases for the stolen PII of specific individuals.  Specifically, Ngo admitted that he offered access to PII for 200 million U.S. citizens, and that more than 1,300 customers from around the world conducted more than three million “queries” through the third-party databases maintained on his websites.

Ngo made nearly $2 million from his scheme.  The Internal Revenue Service has confirmed that 13,673 U.S. citizens, whose stolen PII was sold on Ngo’s websites, have been victimized through the filing of $65 million in fraudulent individual income tax returns.

The case was investigated by the U.S. Secret Service’s Manchester Resident Office.  The case is being prosecuted by Senior Trial Attorney Mona Sedky of the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Arnold H. Huftalen of the District of New Hampshire.

The case out of the District of New Jersey was investigated by the FBI, and is being prosecuted by the U.S. Attorney’s Office of the District of New Jersey.

VIETNAMESE NATIONAL CHARGED IN INTERNATIONAL PERSONALLY IDENTIFIABLE INFORMATION THEFT SCHEME

FROM:  U.S. JUSTICE DEPARTMENT
Friday, October 18, 2013

Vietnamese National Charged in Widespread International Scheme to Steal and Sell Hundreds of Thousands of U.s. Persons’ Personally Identifiable Information
A Vietnamese national has been indicted in the District of New Hampshire for allegedly participating in an international scheme to steal and sell hundreds of thousands of Americans’ personally identifiable information (PII) through various underground websites that he operated.

Acting Assistant Attorney General Mythili Raman of the Justice Department’s Criminal Division, U.S. Attorney John P. Kacavas of the District of New Hampshire, and Resident Agent in Charge Holly Fraumeni of the U.S. Secret Service’s Manchester Field Office made the announcement after the indictment was unsealed.

Hieu Minh Ngo, 24, a Vietnamese national, was charged in a 15-count indictment filed under seal in November 2012, charging him with conspiracy to commit wire fraud, substantive wire fraud, conspiracy to commit identity fraud, substantive identity fraud, aggravated identity theft, conspiracy to commit access device fraud, and substantive access device fraud.  Ngo was arrested upon his entry into the United States in February 2013.  The statutory maximum penalties are five years on the identity fraud and identity fraud conspiracy counts, two years each on the aggravated identity theft counts, 20 years on the wire fraud count and wire fraud conspiracy counts, 10 years on the substantive access device fraud count and five years on the conspiracy to commit access device fraud count.

According to the indictment, from 2007 through 2012, Ngo and other members of the conspiracy acquired, offered for sale, sold, and/or transferred to others packages of PII for more than 500,000 individuals.  These packages, known as “fullz,” typically included a person’s name, date of birth, social security number, bank account number and bank routing number.  During this same time, Ngo and other members of the conspiracy acquired, offered for sale, sold, and/or transferred to others stolen payment card data, which typically included the victim account holder’s payment card number, expiration date, card verification value number, account holder name, account holder address and phone number.

The indictment alleges that Ngo operated one or more online marketplaces for various carding activities, known as carder forums, where he stored and offered for sale “fullz” and other PII, including “fullz” of individuals located in the District of New Hampshire.  On two carder forums, Ngo and his co-conspirators offered buyers the option to obtain a specified quantity of “fullz” or to submit a query of a particular name to obtain that person’s associated PII.  Ngo and his co-conspirators allegedly offered several categories of PII, depending on how recently the data had been acquired, and charged higher prices for more recent data.  Ngo allegedly made arrangements with others who, after paying a fee, could access and then and re-sell the stolen payment card data, “fullz” and other PII.  Ngo and his co-conspirators created one or more accounts with a digital currency service and used those accounts to receive funds for the stolen payment card data, “fullz” and other PII that they sold.

The case was investigated by the U.S. Secret Service and is being prosecuted by Trial Attorney Mona Sedky of the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Arnold H. Huftalen of the District of New Hampshire.

The details contained in the indictment are allegations.  The defendant is presumed to be innocent unless and until proven guilty beyond a reasonable doubt in a court of law.