September 12, 2008 (Computerworld) One of the 11 people arrested last month in connection with the massive data theft at TJX Companies Inc., BJ Wholesale Clubs Inc. and several other retailers pleaded guilty yesterday to four felony counts, including wire and credit card fraud and aggravated identity theft.

Damon Patrick Toey is scheduled to be sentenced on Dec. 10 in U.S. District Court in Boston. He faces a maximum prison term of five years and a fine of $250,000 on each of the counts. In addition, under the terms of the plea agreement, Toey has to forfeit all of the money he earned for his role in the data theft. It is not clear how much he may have made from the attacks, although he had about $9,500 in his possession when he was arrested in May.

Toey was one of 11 alleged hackers arrested last month in connection with a series of data thefts and attempted data thefts at TJX and numerous other companies. Besides TJX and BJ's, the list of publicly identified victims of the hackers includes DSW, OfficeMax, Boston Market, Barnes and Noble, Sports Authority and Forever 21.

In a court filing yesterday, Assistant U.S. Attorney Stephen Heymann said that there is "forensic and/or testimonial evidence" that Toey and his co-conspirators broke into "numerous" other businesses that have not been publicly identified. Heymann said he would be willing to submit the full list "in camera" to the court if needed.

The ID theft ring stole data involving more than 45 million payment cards, leaving 100 or so financial institutions vulnerable to losses from fraud, Heymann said.

The breach was made public in January 2007 by Framingham, Mass.-based TJX, which later reported in a filing with the U.S. Securities and Exchange Commission that 45.6 million credit card numbers were affected -- the largest such breach on record eclipsing the June 2005 CardSystems breach.

(CardSystems was later purchased by Solidus Networks/Pay By Touch)

The alleged thefts by Toey and his companions occurred over a five-year period, from 2003 to 2008, and were largely perpetrated -- at least, initially -- by taking advantage of vulnerabilities in the wireless networks used at retail store locations. Around mid-2007, the group, largely with the help of Toey, started launching online attacks on Web servers and databases handling payment card data. Accused gang leader Albert Gonzalez allegedly invited Toey to move into his condominium in Miami, where he stayed for free and received periodic payments in return for collaborating on the Internet-base attacks.

Many of the Internet attacks that Toey facilitated were SQL injection attacks, according to court documents.

The documents described Gonzalez, Toey and others as going "war-driving" (see War-Driving 101) in commercial areas of Miami looking for vulnerable retail networks they could attack. Once they broke into a network, they would locate and steal "Track 2" data from the magnetic stripe on the back of payment cards as well as PIN-block data associated with debit cards.

The gang allegedly used sophisticated "sniffer" programs to capture password and user account information, which they would then use to break into other corporate servers containing payment card data. The gang also had access to tools that allowed its members to decipher encrypted PINs. The stolen data was then either sold to cybercriminals in Eastern Europe and the U.S. or used to make fraudulent credit and debit cards.

Toey and his gang allegedly maintained servers in the U.S., Latvia and Ukraine that were used to store tens of millions of stolen credit and debit card numbers, according to court documents.

A spokeswoman for the prosecutor's office today said that Gonzalez made his initial court appearance yesterday and pleaded innocent to the charges against him. He remains in custody without bail. His next hearing is scheduled for sometime next month.

The next person scheduled to make a court appearance in connection with the case is Christopher Scott who appears to have played a major role in the data theft at TJX. Scott faces five felony counts, including unlawful access to computers, wire fraud, aggravated identity theft and money laundering.

On two separate occasions in July 2005, Scott compromised two wireless access points at a TJX-owned Marshall's store in Miami. He used the access to download various commands onto TJX servers containing payment card data. In September 2005, Scott and Gonzalez first started downloading payment card data from TJX servers in Framingham.

About a year after gaining access to the TJX network, Scott established a VPN connection between a TJX payment card transaction processing server and a malicious server owned by Gonzalez. That connection, in turn, was used to upload various sniffer programs to the server to capture transaction data as it was being processed.

Scott collected about $400,000 for his part in the data theft and at the time of his arrest, authorities seized about $6,000 in cash, a Rolex watch and nearly two dozen pieces of electronic equipment -- including several laptop computers, storage devices, PDAs and video recorders.