14 DAY TRIAL // A 24-year-old Vietnamese national has been charged in the United States for running a criminal service that has been stealing and selling the personally identifiable information of hundreds of thousands of people.
The suspect, Hieu Minh Ngo, has been charged with conspiracy to commit wire fraud, substantive identity fraud, substantive wire fraud, conspiracy to commit wire fraud, aggravated identity theft, substantive access device fraud, and conspiracy to commit access device fraud.
The 15-count indictment was filed in November 2012, but it was only unsealed last week. Ngo was arrested in February 2013 as he attempted to enter the US.
US authorities allege that Ngo and other members of the conspiracy obtained the details of over 500,000 individuals, including social security numbers, bank account numbers, bank routing numbers, credit card information, addresses, and phone numbers. If found guilty, the suspect could spend many years behind bars.
Security expert Brian Krebs provides some additional information on the service allegedly run by the 24-year-old and his accomplices.
Ngo is said to be the operator of identity theft services such as Superget.info and findget.me. It appears he was fueling Superget.info with information from Court Ventures, a company acquired by Experian in March 2012.
The cybercriminals posed as a private investigator and tricked Court Ventures into giving them access to their databases and the ones of US Info Search, a company with which Court Ventures made an information sharing agreement.
Marc Martin, the CEO of US Info Search, told Krebs that he learned of the incident after being contacted by the US Secret Service. Authorities notified Experian that Court Ventures was selling US Info Search data to Vietnam-based individuals who were using it to fuel an identity theft service.
Martin believes Experian or Court Ventures should have discovered the information leak much sooner, especially since the monthly payments made by Superget.info to Experian came from Singapore.
The companies were tricked into selling US consumer details to the cybercriminal service for almost a year.