 |
| Ngo Minh Hieu (R), one of the most notorious hackers in the U.S.’s history of information security, posing with a man. (Photo: Krebs on Security) |
Ngo Minh Hieu – Started hacker career at 19, gained fame and wealth soon afterward
Ngo Minh Hieu, or Hieupc, born in 1989 in Gia Lai came from a middle-class family that owned an electronics store. In his late teens, Hieu traveled to New Zealand to study English. By that time, he was already an administrator of several dark web hacker forums. Between his studies, he discovered a vulnerability in the school’s network that exposed payment card data.
“I did contact the IT technician there to fix it, but nobody cared so I hacked the whole system,” Hieu said in “Confessions of an ID Theft Kingpin” published by US journalist Brian Krebs. “Then I used the same vulnerability to hack other websites. I was stealing lots of credit cards.”
Hieu said he decided to use the card data to buy concert and event tickets from Ticketmaster, and then sell the tickets at a New Zealand auction site called TradeMe. The university later learned of the intrusion and Ngo’s role in it, and the Auckland police got involved. His travel visa was not renewed after his first semester ended, and in retribution he attacked the university’s site, shutting it down for at least two days. Hieu then got back to Vietnam for studying but spending most of his time on cybercrime forums.
 |
| One of Hieu’s website to sell data. (Photo: VN Express) |
The case of MicroBilt, Court Ventures and Experian
“My friends said doing credit cards and bank information is very dangerous, so I started thinking about selling identities,” Hieu once said. His first big target was a consumer credit reporting company in New Jersey called MicroBilt. “I was in their systems for almost a year without them knowing”, he said. Hieu then launched a website that sold individual consumer records. Matt O’Neill, the US Secret Service agent who in February 2013 successfully executed a scheme to lure Ngo out of Vietnam and into Guam, where the young hacker was arrested and sent to the mainland U.S. to face prosecution, commented about Hieu’s service: “About 99% nearly 100% US people could be found, more than any sites on the internet now.”
According to VN Express, the game with MicroBit ended as Hieu found a much more reliable and stable source of consumer data: A U.S. based company called Court Ventures, which aggregated public records from court documents. Hieu wasn’t interested in the data collected by Court Ventures, but rather in its data-sharing agreement with a third-party data broker called U.S. Info Search, which had access to far more sensitive consumer records. Using forged documents and more than a few lies, Hieu was able to convince Court Ventures that he was a private investigator based in the United States.
In March 2012, Court Ventures was purchased by Experian, one of the big three major consumer credit bureaus in the United States. And for nine months after the acquisition, Ngo Minh Hieu was able to maintain his access. “I was paying Experian good money, thousands of dollars a month”, the hacker said.
 |
| Hieu was arrested in 2013 and was put on trial in 2015. (Photo: Soha) |
Caught by US Police and 7 years in jail
As Hieu hacked in Experian, Matt O’Neill and his fellow agents found a handful of his guilty proof. They then contact Experian, who quickly zeroed in on Ngo’s accounts and shut them down. The Secret Service contacted Ngo through an intermediary in the United Kingdom and told Ngo he had personally shut down Ngo’s access to Experian because he had been there first and Ngo was interfering with his business, then asked him to arrange a meeting in Guam to settle down the issue, where, in fact, the US police was waiting. But Hieu was not lured. Instead, he weaseled his way into another huge data store, called TLO in much the same way he’d gained access to Court Ventures.
By this time, Ngo was a multi-millionaire: His various sites and reselling agreements with three Russian-language cybercriminal stores online had earned him more than USD $3 million. He told his parents his money came from helping companies develop websites, and even used some of his ill-gotten gains to pay off the family’s debts, said VN Express.
Secret Service then took their chance again as TLO shut Hieu’s accounts. Through the mentioned UK hacker, they again contact Hieu, asking to meet in Guam. Hieu agreed, as he was “so desperate to have a stable database”. Immediately after stepping off of the plane in Guam, he was apprehended by Secret Service agents.
 |
| On December 3, Hieu published a photo on his social media account, saying that he was applied for The National Cyber Security Center (Photo: Soha) |
Hired by a cybersecurity agency under Vietnam’s Ministry of Information and Communications.
According to Krebs on Security, Hieu, 31, is one of the most notorious hackers in the U.S.’s history of information security. He was arrested in 2013 and was put on trial in 2015. The Vietnamese man was sentenced to 13 years in prison for hacking into U.S. businesses’ computers, stealing personally identifiable information (PII), and selling to other cybercriminals his fraudulently-obtained access to PII belonging to approximately 200 million U.S. citizens.
He later cooperated with U.S. police in the arrest of about 20 people who used his data service for their criminal schemes, as well as testified against these people at their trials. After spending seven years behind bars, Hieu was released and allowed to return to Vietnam in 2020.
On December 3, Hieu published a photo on his social media account, saying that he was applied for The National Cyber Security Center (NCSC). The center then replied to reporters that they were “in the process of recruiting Ngo Minh Hieu, a.k.a. Hieupc, as its technical expert”, according to Tuoi Tre. Hieu will be participating in research aimed at better ensuring information security for local residents and businesses, the representative elaborated, adding that his tasks will be assigned and supervised by the NCSC for the common goal of protecting the people in cyberspace. Hieu will be able to use his talent in suitable activities, helping protect the security and safety of national cyberspace. Meanwhile, the NCSC will have a competent technical expert to better protect the country, people, and businesses in an increasingly complex and risky network environment, the center said.
