A number of US states are investigating the incident

Apr 4, 2014 09:08 GMT  ·  By

Last year, investigative journalist Brian Krebs revealed that a Vietnamese man running an online identity theft service managed to gain access to the details of hundreds of millions of Americans through an Experian subsidiary. US authorities are said to be investigating the data breach.

24-year-old Hieu Minh Ngo – who has already been arrested and pleaded guilty – had fueled his criminal service with data from US Info Search. This company had an arrangement with Court Ventures according to which they could access each other’s data.

The Vietnamese man made a contract with Court Ventures, but the company was acquired by Experian in March 2012. Experian failed to notice that anything was amiss for several months after the acquisition.

Now, Reuters reports that a number of US states are investigating the incident. Experian representatives have told the media giant that Ngo’s access to the data was cut off when the Court Ventures portal was shut down in early December 2012.

US authorities haven’t revealed if they know how many individuals are impacted by the breach, and no specific cases of data from Court Ventures being used for identity theft have been identified.

Experian says that it’s working on determining what records are impacted, but so far, neither Experian nor US Info Search has notified customers because they haven’t been able to identify those affected by the breach.

Ngo was arrested in February 2013 after being lured to the United States by the Secret Service. The operator of the identity theft service was expecting to close a business deal in the US.

Last month, the suspect pleaded guilty to wire fraud, access device fraud, and identity theft. He was charged in October 2013.

Authorities said he had over 1,300 customers who had paid him around $1.9 million (€1.25 million) between 2007 and the time of his arrest. In the 18-month period before he was arrested, Ngo’s customers made around 3.1 million queries on his website. The service offered social security numbers, dates of birth, addresses, phone numbers, email addresses and other data.

At his trial, Ngo told the judge that he had some medical problems, namely that he kekepteps hearing voices in his head. His lawyer said he didn’t know anything about his client’s issues until that point.

Ngo will be sentenced on June 16 and he faces up to 46 years in jail for his crimes.