Target said it was among the victims of computer hacker Albert Gonzalez, mastermind of the biggest identity theft in U.S. history.
The 28-year-old college dropout pleaded guilty on Tuesday to charges that he stole more than 170 million payment card numbers by breaking into corporate computer systems from businesses including Target.
Gonzalez, under the plea agreement, faces 17 years to 25 years in prison when he is sentenced in March.
Target spokeswoman Amy Reilly said her company was among the victims, having had an “extremely limited” number of payment card numbers stolen by Gonzalez about two years ago.
She declined to say how many card numbers had been stolen, and described the term of the exposure as brief.
“A previously planned security enhancement was already under way at the time the criminal activity against Target occurred,” Reilly said. “We believe that, at most, only a tiny fraction of guest credit and debit card data used at our stores may have been involved.”
She said that Target had notified the card issuers, leaving them to tell their customers.
Prosecutors previously identified other victims in the case as payment card processor Heartland Payment Systems, 7-Eleven, the Hannaford chain of New England grocery stores and another unidentified firm.
Gonzalez pleaded guilty in September to computer break-ins at retailers TJX, BJ’s Wholesale Club and Barnes & Noble, in a separate case before U.S. District Judge Patti Saris.
Gonzalez, who appeared in court on Tuesday wearing a beige prison uniform, told U.S. District Judge Douglas Woodlock that he had abused alcohol and illegal drugs for years. He said he had used marijuana, cocaine, LSD, ketamine and hallucinogenic mushrooms.
“It’s one of the reasons to explain why a young man in his 20s did these things,” his lawyer, Martin Weinberg, told reporters.
Gonzalez made the formal plea in the U.S. District Court of Massachusetts in Boston on Tuesday, reiterating the terms of an agreement he had signed with prosecutors.
“You face a considerable amount of time in jail as a result of your plea,” Judge Woodlock told Gonzalez. “All aspects of your life are to be affected.”
Asperger’s disorder a cause?
A psychiatrist hired by Gonzalez said in court papers that the hacker’s criminal behavior “was consistent with the description of the Asperger’s disorder.”
Prosecutors have petitioned the court to perform their own psychiatric evaluation of Gonzalez, but Weinberg sought to block that request.
“He’s admitted responsibility. He is remorseful,” Weinberg told reporters.
At the same courthouse last week, one of Gonzalez’s conspirators, Stephen Watt of New York, was sentenced to two years in prison for developing the software used to capture payment card data. He was also ordered to pay $171.5 million in restitution.
The cases are: U.S. v Albert Gonzalez in U.S. District Court in Massachusetts No. 10223 and No. 10382.