{
  "id": "case-gonzalez-carding",
  "slug": "us-v-albert-gonzalez-tjx-heartland",
  "title": "U.S. v. Albert Gonzalez (TJX & Heartland Payment Systems)",
  "summary": "Mastermind of the largest credit card theft operation in history at the time, hacking TJX Companies, BJ's Wholesale Club, OfficeMax, and Heartland Payment Systems, stealing over 130 million payment cards.",
  "case_number": "1:08-cr-10223",
  "court": "U.S. District Court for the District of Massachusetts",
  "district": "D. Mass.",
  "country": "United States",
  "opened_at": "2008-08-05",
  "status": "sentenced",
  "victim_sector": "Retail, Financial Payment Processors",
  "victim_country": "United States",
  "loss_amount_usd": 200000000,
  "loss_amount_note": "Direct merchant and bank losses in excess of $200 million across TJX and Heartland.",
  "first_seen_at": "2005-07-01T00:00:00Z",
  "last_updated_at": "2026-09-06T10:00:00Z",
  "actor_slug": "shadowcrew",
  "defendant_slugs": [
    "albert-gonzalez"
  ],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1190",
      "evidence_excerpt": "Gonzalez used automated SQL injection scripts against web servers to gain back-end access to internal payment processing networks.",
      "evidence_locator": "Indictment \u00b6 14, Page 6",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Indictment: U.S. v. Gonzalez",
      "source_url": "https://www.justice.gov/opa/pr/former-secret-service-informant-sentenced-20-years-prison-massive-credit-card-theft",
      "technique_name": "Exploit Public-Facing Application",
      "tactic": "Initial Access"
    },
    {
      "technique_id": "T1041",
      "evidence_excerpt": "Installed packet sniffer utilities inside Heartland's payment processing network that captured unencrypted credit card magnetic stripe data during authorization.",
      "evidence_locator": "Indictment \u00b6 22, Page 10",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Indictment",
      "source_url": "https://www.justice.gov/opa/pr/former-secret-service-informant-sentenced-20-years-prison-massive-credit-card-theft",
      "technique_name": "Exfiltration Over C2 Channel",
      "tactic": "Exfiltration"
    }
  ],
  "events": [
    {
      "event_type": "arrest",
      "event_date": "2008-05-07",
      "description": "Gonzalez arrested in a Miami Beach hotel room by U.S. Secret Service agents."
    },
    {
      "event_type": "plea",
      "event_date": "2009-08-28",
      "description": "Pleads guilty to 19 counts of conspiracy, computer fraud, wire fraud, and aggravated identity theft."
    },
    {
      "event_type": "sentencing",
      "event_date": "2010-03-25",
      "description": "Sentenced to 240 months (20 years) in federal prison."
    }
  ]
}