Albert Gonzalez "soupnazi / segvec / cumbajohnny"

Albert Gonzalez was already a federal informant when he masterminded what was, at the time, the largest payment-card theft in history. The US Secret Service had arrested him in 2003 for ATM fraud and turned him into a co-operating witness on Operation Firewall — a long-running takedown of the carding marketplace ShadowCrew. He provided real value to the investigators. He also used the experience to gain a working understanding of how federal cybercrime prosecutions are built, and quietly assembled a parallel crew that ran the TJX (94 million cards), Hannaford (4.2 million), Heartland (130 million), and Dave & Buster’s intrusions while he was on the Secret Service’s payroll.

The technique was patient SQL injection against retailer-facing web applications, followed by months of lateral movement until his crew reached the point-of-sale or payment-processing systems where card data could be intercepted in transit. Gonzalez was arrested in 2008 — eventually, the prosecutors he had been helping caught the patterns — and pleaded guilty in 2009. He was sentenced in 2010 to two concurrent 20-year terms. He is currently held at federal facility USP Yazoo City, Mississippi, with a projected release date in 2025.

The Gonzalez story is the canonical case study for “the informant who never actually stopped”. It is also the human face of every breach that followed at the same architectural pattern: SQL injection on a public web property, lateral movement on a flat internal network, payment-card theft from systems that had been considered “internal-only”. His crew’s victims paid out roughly $300 million in settlements and remediation costs collectively.