Under an agreement with prosecutors in Boston today, Gonzalez, 28, will face a maximum of 25 years in prison and will forfeit more than $2.8 million in cash.
Gonzalez was arrested in Miami in 2008 along with 10 other individuals. He was indicted separately in federal court in Boston and in New York on charges relating to the thefts at TJX, Dave & Busters, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, Forever 21 and DSW.
Earlier this month, Gonzalez was also indicted in New Jersey on charges that he, along with two unidentified Russian accomplices, was responsible for huge data thefts at Heartland, Hannaford, 7-Eleven Inc. and two other unnamed retailers. Prosecutors alleged that the three were responsible for stealing data on more than 130 million credit and debit cards for the five retailers. Today's plea deal does not include his indictment on these charges.
At the time of the New Jersey indictments, Gonzalez' attorney Rene Palomino had claimed that his client had been close to agreeing to a plea bargain in connection with the charges filed against him in 2008. In an interview with Computerworld, Palomino had said that he was working with federal authorities to hammer out a new plea agreement after the indictments on the Heartland case and other charges.
Palomino had also claimed in an interview with the New York Times that he intended to argue in court that Gonzalez was not the mastermind of the Heartland breach and that it was one of his client's accomplices who had pulled off the heist.
A spokeswoman at the U.S. attorney's office in Boston said she couldn't comment on whether the plea agreement covered the indictments in New York and New Jersey. However the Reuters news service reported that today's agreement does resolve the indictments in New York. It was unclear where Reuters obtained that information, but it would to be consistent with statements that Gonzalez' attorney had made recently about the plea agreement that was being neogotiated before the indictments in New Jersey. Meanwhile, a spokesman for the U.S. attorney's office in New Jersey said today's agreement in Boston does not resolve the charges in New Jersey.
Avivah Litan, a Gartner Inc. analyst who has been following the cases, called the prison term in the proposed plea agreement reasonable. "After all, no one got physically injured or killed, and this was a white collar crime that mainly hurt the card issuing banks, which were able to recoup most -- if not all -- of their losses from the breached retailers," she said.
At the same time, "the sentence is certainly tough enough to hopefully deter future Gonzalez wannabes," she said.
Several of those arrested with Gonzalez last year in connection with the data heists at TJX and elsewhere have pleaded guilty and are awaiting sentencing.
Among them are Stephen Watt, 26, of New York, who supplied many of the sophisticated packet-sniffer programs that Gonzalez and his accomplices used to identify and capture credit and debit card data from the networks they had broken into. Prosecutors are seeking a three-year term for Scott , who pleaded guilty to one felony count of conspiracy.
Another accomplice who pleaded guilty was Christopher Scott, 26, of Miami, who was described by federal authorities as one of the key wireless hacking experts in Gonzalez's gang. Scott is the one who is alleged to have first broken into the TJX network via a weak wireless access point at a Marshall's store in Miami in 2005. He is scheduled to be sentenced in November.
A third individual who is awaiting similar sentencing is Damon Patrick Toey, also of Miami. Toey is alleged to have helped Gonzalez break into retail networks via SQL Injection attacks. He is the one that Palamino now says was the individual responsible for the Heartland break-in.