Ngo Minh Hieu, a 24-year-old Vietnamese national, has been indicted in the US for allegedly participating in a scheme to steal and sell more than hundreds of thousands of Americans' personally identifiable information (PII) online, according to a US court. Hieu, who lived in New Zealand and Vietnam, was arrested on his arrival in Guam, USA, in February 2013, and was then taken to New Hampshire.    According to the indictment unsealed last week by the U.S. District Court for the District of New Hampshire, Hieu and his co-conspirators acquired and sold packages of PII for more than 500,000 people from 2007 through 2012. The packages, called "fullz," typically included names, birthdates, bank account numbers, bank routing numbers and Social Security numbers. He and his co-conspirators also allegedly acquired and sold stolen payment card data, including names, addresses, phone numbers, payment card numbers, expiration dates and CVV numbers. The indictment alleges that Hieu operated several online carder forums where data was offered for sale, including sites where buyers had the option to submit a query for a specific name in order to obtain that person's associated PII. According to court documents, Hieu operated superget.info and a similar ID theft service called findget.me, along with an unnamed co-conspirator, identified in the complaint only as John Doe One. These services specialized in selling “fullz” or “fulls,” a slang term that cybercrooks use to describe a package of personally identifiable information that typically includes the following information: an individual’s name, address, Social Security number, date of birth, place of work, duration of work, state driver’s license number, mother’s maiden name, bank account number(s), bank routing number(s), email account(s) and other account passwords. “Fulls” are most commonly used to take over the identity of a person in order to engage in other fraud, such as taking out loans in the victim’s name or filing fraudulent tax refund requests with the IRS. Hieu and his conspirators often sold huge packages of PII, the indictment said.   For example, they offered to sell a package of 4,000 credit cards for US$4,600 plus $500 as the server fee. On November 26, 2011 they offered a package of 22,000 credit cards for $5,000 and another package of 50,000 cards for $10,000.Cheating US credit bureau According to a report from Krebs on Security, one of the top US credit bureaus was scammed into selling social security numbers to Hieu for months.  Experian — one of the three national US credit bureaus — reportedly sold SSNs through its subsidiary, Court Ventures, to Hieu, who allegedly operated an identity theft service called SuperGet.info. The site also sold drivers license, bank account, and credit card numbers along with other personal data, though it's not clear how much of it came from Experian. The alleged fraudster posed as a private investigator, wrote Krebs on Security. Though Experian holds highly personal information so that it can issue credit reports, it may at times sell that information to other ostensibly discreet parties that offer services such as fraud prevention. By posing as a US-based private investigator in need of such information, Hieu was able to gain access to Experian's data through Court Ventures, reports Krebs. But while Court Ventures only discovered the mishap after it was alerted by the US Secret Service, Krebs writes that the company didn't catch odd inconsistencies with Hieu's story, such as his monthly payments coming through wire transfers from Singapore. Also according to the indictment, Hieu and his accomplices also set up an account with “Liberty Reserve”, a large money laundering organization that was uncovered in May 2013 when four members of the organization were indicted in Vietnam’s northern Hai Phong City, to receive payments from selling PII. In addition, while living in New Zealand, Hieu was once alleged to commit a credit swindle through TradeMe, an auction website similar to eBay. New Zealand media cited a TradeMe representative as saying that Hieu then admitted it was a scam. After Hieu returned to Vietnam and failed to obtain a visa to return to New Zealand, in July 2009 he hacked the website of his former university, Unitec Institute of Technology in Auckland, where he had studied since 2008, causing the site to stop working for two days. He later hacked the site of Auckland University.In face of 15 charges, 50 years in jail He is currently facing 15 separate criminal charges, including wire fraud, substantive wire fraud, substantive identity fraud, aggravated identity theft, conspiracy to commit identity fraud, substantive access device fraud, and conspiracy to commit access device fraud, among others. If convicted on all counts, Hieu could be facing a very lengthy prison sentence, up to 50 years.

According to a statement on the Hieu case released October 19 by the Justice Department and New Hampshire U.S. Attorney John P. Kacavas, the statutory maximum penalties are: five years on the identity fraud and identity fraud conspiracy counts; two years each on the aggravated identity theft counts; 20 years on the wire fraud count and wire fraud conspiracy counts; 10 years on the substantive access device fraud count; and five years on the conspiracy to commit access device fraud count.Move from Cam Ranh to HCMC From Hieu’s personal record, Tuoi Tre has found that Hieu’s family once lived on 22/8 Street in Cam Ranh City, Khanh Hoa Province. According to local records,    Hieu is the youngest child in his family, with two older sisters. They were all born in Pleiku City, Gia Lai Province. Many residents on 22/8 Street said Hieu’s family once ran a large home electronics shop in the area. They also said that “the shop’s owner had a son who was very good at computer science and information technology.” Five years ago, Hieu’s family’s business was thriving so well, they bought the house next-door and Hieu purchased a sports car worth billions of dong (VND1 billion = $48,000). Staff Sergeant Pham Quoc Huy, a police officer in charge of the quarter where Hieu’s family’s house is located, said that two years ago this family suddenly moved from Cam Ranh to HCMC.Tuoi Tre has recently contacted Mr. N.V.H., Hieu’s father, who said his family is living in HCMC’s Tan Binh District. When Tuoi Tre asked him about Hieu’s activities in New Zealand and the US, he said he was busy and hung up. The newspaper’s correspondents have failed to contact him again. A source told Tuoi Tre that Hieu left Vietnam in February, which coincides with the time that a US security agency reported they had arrested him.