Hieu Minh Ngo

Ngô Minh Hiếu is a Vietnamese national.[5]

In his late teens, he traveled to New Zealand to study English at a university there. By that time, he was already an administrator of several dark web hacker forums, and between his studies he discovered a vulnerability in the school’s network that exposed payment card data. “I did contact the IT technician there to fix it, but nobody cared so I hacked the whole system,” Ngô recalled. “Then I used the same vulnerability to hack other websites. I was stealing lots of credit cards.” Ngô said he decided to use the card data to buy concert and event tickets from Ticketmaster, and then sell the tickets at a New Zealand auction site called TradeMe. The university later learned of the intrusion and Ngô’s role in it, and the Auckland police got involved.[1] Ngô’s travel visa was not renewed after his first semester ended, and in retribution he attacked the university’s site, shutting it down for at least two days.[1]

From 2007 to 2013, he operated a "massive international hacking and identity theft scheme from his home in Vietnam" in which he stole personally identifiable information (such as names, Social Security numbers, and bank account data) of 200 million U.S. citizens.[6] Ngô obtained this data by hacking companies' databases, then advertised and offered (on two websites he operated, which were later shuttered) the stolen information for purchase by other cybercriminals.[7] Ngô was also able to obtain data from Court Ventures, an Experian subsidiary,[8][9] by "posing as a private investigator operating out of Singapore."[10]

Ngo made nearly $2 million from his scheme.[5][6][2] The Internal Revenue Service has confirmed that 13,673 U.S. citizens, whose stolen PII was sold on Ngo’s websites, have been victimized through the filing of $65 million in fraudulent individual income tax returns. [11]

In February 2013, Ngô Minh Hiếu entered the United States territory and was arrested[6] after U.S. Secret Service investigators lured Hiếu to Guam "to consummate a business deal with a man he believed could deliver huge volumes of consumers' personal and financial data for resale."[10] He subsequently pleaded guilty to federal crimes: (1) wire fraud, (2) identity fraud, (3) access device fraud, and (4) four counts of computer fraud and abuse. Ngô had been facing more than 24 years in federal prison, but his sentence was lightened because he cooperated with investigators to secure the arrest of at least a dozen of his U.S.-based customers.[12][13]

The Secret Service had difficulty pinning down the exact amount of financial damage inflicted by Ngo’s various ID theft services over the years, primarily because those services only kept records of what customers searched for — not which records they purchased. But based on the records they did have, the government estimated that Ngo’s service enabled approximately $1.1 billion in new account fraud at banks and retailers throughout the United States, and roughly $65 million in tax refund fraud with the states and the IRS. [14]

In July 2015, U.S. District Judge Paul J. Barbadoro sentenced Hiếu, then age 25, to 13 years in prison.[5][6]The Bureau of Prisons lists his register number as 03664-093 and his release date was 11/20/2019. In the final months of his detention, Ngô started reading everything he could get his hands on about computer and Internet security, and even authored a lengthy guide written for the average Internet user with advice about how to avoid getting hacked or becoming the victim of identity theft.

Longer term, Ngô says, he wants to mentor young people and help guide them on the right path, and away from cybercrime. He’s been brutally honest about his crimes and the destruction he’s caused. His LinkedIn profile states up front that he’s a convicted cybercriminal.