📸 Photo

KINGPIN

perception by others that computer systems may be vulnerable.” Consequently, the eighty thousand victims were never notified that their names, addresses, and credit card numbers had been offered for sale on IRC.

In 2003, the state of California effectively ended such cover-ups when the legislature enacted SB1386, the nation's first compulsory breach-disclosure law. The law requires hacked organizations doing business in the Golden State to promptly warn potential identity theft victims of a breach. In the years that followed, forty-five other states passed similar legislation. Now no significant breach of consumer data remains a secret for long, once detected by the company and the banks.

The headlines over the giant retail breaches only added luster to Maksik's product—he didn't try to hide the fact that he was vending the dumps from the retail chains. When the TJX attack made news in January 2007, the details that emerged also confirmed what many carders already suspected: the Ukrainian had a stateside hacker supplying him with dumps. Maksik was a middleman for a mystery hacker in the States.

In mid-2006, the hacker was apparently in Miami, where he parked at two TJX-owned Marshalls outlets and cracked the stores' Wi-Fi encryption. From there, he hopped on the local network and swam upstream to the corporate headquarters, where he launched a packet sniffer to capture credit card transactions live from the Marshalls, T. J. Maxx, and HomeGoods stores around the country. The sniffer, an investigation would later find, ran undetected for seven months.

Max had a rival in America, and a damn good one.

Thanks in large part to Maksik's hacker and Max Vision, the popular consumer impression that Web transactions were less secure than real-life purchases was now completely false. In 2007, the majority of compromised cards were stolen from brick-and-mortar retailers and restaurants. The large retail intrusions were compromising millions of cards at a time, but breaches at smaller merchants were far more common—Visa's analysis found 83 percent of credit card breaches were at merchants processing one