A Vietnamese man who ran an online identity theft service that sold access to Social Security numbers and other personal information on more than 200 million Americans has been sentenced to 13 years in a U.S. prison.
Vietnamese national Hieu Minh Ngo was sentenced to 13 years in prison for running an identity theft service.
Hieu Minh Ngo, 25, ran an ID theft service variously named Superget.info and findget.me. Ngo admitted hacking into or otherwise illegally gaining access to databases belonging to some of the world’s largest data brokers, including a Court Ventures, a subsidiary of the major consumer credit bureau Experian.
Ngo’s service sold access to “fullz,” the slang term for packages of consumer data that could be used to commit identity theft in victims’ names. The government says Ngo made nearly $2 million from his scheme.
The totality of damage caused by his more than 1,300 customers is unknown, but it is clear that Ngo’s service was quite popular among ID thieves involved in filing fraudulent tax refund requests with the U.S. Internal Revenue Service (IRS). According to the Justice Department, the IRS has confirmed that 13,673 U.S. citizens, whose stolen PII was sold on Ngo’s websites, have been victimized through the filing of $65 million in fraudulent individual income tax returns.
“From his home in Vietnam, Ngo used Internet marketplaces to offer for sale millions of stolen identities of U.S. citizens to more than a thousand cyber criminals scattered throughout the world,” said Assistant Attorney General Leslie R. Caldwell, in a press release. “Criminals buy and sell stolen identity information because they see it as a low-risk, high-reward proposition. Identifying and prosecuting cybercriminals like Ngo is one of the ways we’re working to change that cost-benefit analysis.”
Superget.info allowed users search for specific individuals by name, city, and state. Each “credit” cost USD$1, and a successful hit on a Social Security number or date of birth cost 3 credits each. The more credits you bought, the cheaper the searches were per credit: Six credits cost $4.99; 35 credits cost $20.99, and $100.99 bought you 230 credits. Customers with special needs could avail themselves of the “reseller plan,” which promised 1,500 credits for $500.99, and 3,500 credits for $1000.99.
Lance Ealy, one of Ngo’s customers, is now in prison for tax ID theft.
Ngo was arrested in 2013, after he was lured to Guam with the offer of access to more consumer data by an undercover U.S. Secret Service agent. Ngo had been facing more than 24 years in federal prison, but his sentence was lightened because he cooperated with investigators to secure the arrest of at least a dozen of his U.S.-based customers. Among them was an Ohio man who led U.S. Marshals on a multi-state pursuit after his conviction on charges of filing phony tax refund requests with the IRS. Investigators close to the case say additional arrests of Ngo’s former customers are pending.
It remains unclear what, if any, consequences there may be going forward for Experian or its subsidiary, Court Ventures. Ngo gained access to the latter’s consumer database by posing as a private investigator based in the United States. In March 2012, Court Ventures was acquired by Experian, and for approximately ten months past that date, Ngo continued paying for his customers’ data searches via cash wire transfers from a bank in Singapore.
In December 2013, an executive from big-three credit reporting bureau Experian told Congress that the company was not aware of any consumers who had been harmed by an incident. Clearly, the facts unveiled in Ngo’s sentencing show otherwise.
I first wrote about Ngo’s service in November 2011. For more on the fallout from this investigation, see this series.
Hieu Minh Ngo will be doing “sucky sucky, long long time” in the federal prison
Thanks for posting about this, clearly people are reading your articles and paying attention to what’s being written.
Ahhhh the unlucky 13 years. More of these harsh sentences should be dished out. Its like robbing a bank. minimum mandatory sentences per count.
Another win for the human race when a vile character like this is made an example.
13 years a US prison is nothing for the damage that these miscreants cause. Public hanging’s in the offender’s hometown would be more effective. Sending them over to a Turkish prison for life is more appropriate…short of the public hanging.
Really, seriously, it had to be a picture of a black man? Is that racial equality or racism?
It’s a fact in this case, not racism. Mr. Ealy was a particularly colorful character that I wrote about in several stories. It’s also a fact that many of the other men rounded up as a result of this investigation were African American, including, Kendrick Okafor, Babatunde Pedro, Oluwaseun Adekoya, Idris Soyemi, to name a few.
Okafor.babatundr are from Nigeria
Does it really matter WHERE they came from? Whether it was from Park Avenue or Kigali, Rwanda … crime is still crime.
Most Africa countries do not yet have such laws on their books, therefore not illegal.
Africa is not a state in America so not really sure how someone can be an African American in the first place.
When I was a child I thought of everyone as Americans.
I remember the first time I was filling out a form that asked my race. I did not know what that word was or what to put there.
As I got older I discovered it was politically “correct” to call black people African, Hispanics Latinos, whites Caucasian, foreigners aliens etc.
Seems to me that being “correct” actually promotes racism.
I always fill in “NASCAR” for the race question…
Kevin, you just made my day! NASCAR!!! I Love it!
A bit off topic from Brian’s post, but I think I’ll make a small contribution to this side discussion.
The concept of melting pot nation relies on people coming from someplace, and while all are Americans, no one should have to be ashamed of or be forced to reject or deny their roots. If they like to relate back on the origins of their ancestors and the story that leads to them, there is no harm in it for anybody else. Everybody should be free to describe themselves as they see fit, be it x-American, or y-American, etc.
When one doesn’t exactly know where, or from what tribe, one’s ancestors came from due to them being kidnapped and sold into slavery for profit, and before the rise of defined colonies and nation states on the African continent, it is nigh impossible to use a more precise adjective than “African”.
We don’t deny other folks the right to identify as Irish Americans, or German Americans, so it seems fair to employ the term african americans too. I don’t see it as a replacement for the word black, just as I don’t see any hyphenated American nown as a replacement for white. Although closely related, I don’t use the origin description as a replacement for the skin color description.
Note, since there is no edit function, and I spotted mistakes (noun) and inconsistencies in hyphenation and capitalization, please note there is nothing implied by my capitalization of Irish and German yet not having done so with African. These differences stem not from bias in my part but from sloppiness and no way to correct them.
No more an indication of racial equality(racist inference, anyone? Really, seriously.) or racism any more than the name Elizabeth White is an indication of presumed racial superiority.
Followers of Krebs blog will recall how the man shown Tweeted his pic with the RoadRunner when he jumped bail. But unlike the iconic cartoon, this guy seemed to have more in common with Wile E. Coyote.
Had to turn it into racism you troll? Tired of over sensitive people. Look at the guy’s picture. He isn’t trying to be anything but a thug.
Really? C’mon Elizabeth “White.” (And is that your real name or some sort of racist last name picked just for this comment?) Seems to me your original comment is pretty racist in the same vein as the “all white people are racist” bullcrap I continually see. You know what would make racism disappear about a bazillionty times faster? Stop calling everything racist. It’s almost like trying to force people to be tolerant.
Criminals like Hieu will be out before completing full term. Once out, they will be doing exactly the same thing again. The more appropriate sentence for criminals like Hieu would be life in prison at least.
In the U.S. Federal Court system, there is no getting out early for good behavior, etc. He will have to serve his full term. Then he will be deported.
That is incorrect. There is GCT in the Federal Prison system. Everyone gets GCT 54 days credit per year if he has a HS or GED diploma. He will earn 54*13=702 days which is just under two years credit. So he will serve 11 years total then be held on a detainer and then deported. There is no parole in the Federal system, its called Supervised Release instead. People get them confused all the time.
Reference USBOP
OPI: CPD/ISM
NUMBER: P5884.03
DATE: 3/31/2006
SUBJECT: Good Conduct Time
Under the Prison
Litigation Reform Act
RULES EFFECTIVE: 12/5/2005
Thanks for the correction, Richard.
I’ve read all of the back articles regarding Ngo and his Superget site and I’m a bit confused. Did he sell pre-packaged “fullz”, e.g. a list of names with personal data, or did he sell access to the databases themselves, as implied in one of the earlier articles, where buyers could look up the data for an individual they already had targeted?
He did both from what I remember of earlier articles. You could get random ones or lookup if you had certain info already to see if you could get more.
Don’t you wonder if it would be smarter to hire him than to jail him? We can use all the help we can get…
Bonnie, I’m sure that the Feds got all of the info out of Ngo that they could in order to lead more arrests before he is sent away, and they will continue to get even more information out of him, while he is locked up. It’s too good of a resource to go to waste.
As to the super-sensitive poster above, grow up, Ealy is the corrupt son of a corrupt politician in the Southeastern US who tried to run away from the authorities after he was busted. The fact that they are both black has zero to do with anything.
No official post about the darkode carckdown?
Where’s General Nguyen Ngoc Loan when you need him.
I’m old enough not to have to look that reference up on google.
I haven’t looked, but I’m guessing he’s the South Vietnamese General who, on live TV, executed a P.O.W. with a pistol gun shot to the back of the head.
Under the Third Geneva Convention, to be recognized as a prisoner of war, one must bear fixed distinguishing markings, visible from a distance — that is to say a uniform or the equivalent. (There are other requirements, but this requirement is relevant in the present case.)
One could, of course, declare all violent acts to be (ipso facto) acts of war, but then all captured criminals would be POWs.
In the first paragraph, you cite that the service sold access to information of 200 million Americans.
Is this accurate? If so, wouldn’t this indicate that over 2/3rds of the American population has (potentially) had their information stolen?
That would be true since he had access to to the Experian consumer credit database.
Brian, I can recommend you an excellent doctor to treat your acute dementia. His name is dr. Kevorkian. I’m sure that he will help you to forget all your diseases.
@Brian: Can’t say I’m happy to see a banner add for Kevin Mitnick on your site.
I hear Obummer plans to release all the Federal inmates his last day in office.
So how many senior managers, who sold this individual access, while playing fast, loose and greedy, with people’s private details were similarly prosecuted? We’re their companies fined or forced to fix their systems to prevent similar in the future? Was any regulation enacted?
Sadly, I fear that nothing other than prosecution of this person.
Yep, it’s the guy in the nice Brooks Brothers suit who’s a bigger threat to your wallet than the small fry. I detest them even more than the guy getting 13 years.
Can we just settle on “DIRT-BAGS” everybody knows what dirtbags are right? Glad to see we are making progress against them. Experian was sloppy, in my opinion, vetting him in the 1st place. Thanks Brian for the updates
The credit bureaus are responsible for this identity theft. It is nothing more than gov sponsored extortion, to allow them to sell their customers info for profit without the customers express consent. How the hell is anyone supposed to protect their own identity when the credit bureaus are allowed do this? Good luck keeping that ‘good’ credit rating after these jokers have hacked it all over town. Better off using cash. At least that can’t be hacked as easily. Yet.
http://www.examiner.com/article/credit-bureau-s-tactics-called-extortion
I love how one person’s comment on race derailed an entire conversation that was supposed to be about security. Screw you Elizabeth White.