Albert Gonzalez, the alleged ringleader of one of the largest known identity theft cases in U.S. history, has agreed to plead guilty to all 19 counts of related charges against him, according to court documents filed Friday.
Gonzalez, 28, of Miami, was accused in August 2008 of helping steal millions of credit card and debit card numbers from major U.S. retail chains. Among the retailers hacked were TJX Companies (owner of T.J.Maxx), BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, Forever21, and DSW.
Under the plea agreement filed with the U.S. Attorneys Office in Boston, Gonzalez would serve a sentence of 15 to 25 years after pleading guilty by September 11 to charges of conspiracy, wire fraud, aggravated identity theft, and money laundering (PDF).
Gonzalez, who is already in jail, would also have to forfeit a range of possessions, such as almost $3 million in cash, his Miami condominium, a 2006 BMW, several computers, and three Rolex watches.
The agreement also resolves 2008 charges pending against Gonzalez in federal court in New York for hacking the computer network of Dave & Buster's restaurant chain.
A former federal government informant, Gonzalez was also recently indicted in New Jersey, along with two unnamed Russian men, on charges of hacking into Heartland Payment Systems, as well as systems for 7-Eleven, the Hannaford Brothers supermarket chain, and two unnamed corporate victims. They also allegedly stole data related to more than 130 million credit and debit cards. This is considered to be one of the biggest data breach cases in U.S. history.
Rene Palomino, who is listed as Gonzalez's attorney within Friday's plea agreement, did not immediately return a call seeking comment.