04 Mar Hieu Minh Ngo’s Conviction And Redemption
Notorious Vietnamese hacker and identity thief puts on a white hat
Melbourne, Australia – Mar. 4, 2022
Some people collect baseball cards, vintage cars or classic action figures — but for two years of Hieu Minh Ngo’s life, the biggest thrill came from collecting the personal information of more than 3 million other people, then selling it to cybercriminals on the dark web.
In retrospect, he says, “I was too young and dumb” to appreciate the consequences of what he was doing — siphoning identity-related information like Social Security numbers, driver’s licenses, bank account and credit card details into dark web forums where he sold them for 50 cents or a dollar each.
“I saw the easy money coming, and at the time my mind just told me it was just numbers and letters,” Hieu told Cybercrime Magazine. “I just sold them to cybercriminals, and whatever they would do, I didn’t really care.”
“It was how I made money to live a lavish lifestyle at a young age,” he continued. “Sometimes I felt like I was on top of the world — always into five-star hotels and business class. So I kept going, chasing the money until I got locked up.”
Hieu’s habit emerged from a hacking spree as a student in New Zealand, which ultimately attracted a police investigation and got him deported.
Cybercrime Radio: Identity Theft
Hieu Minh Ngo, Former Cybercriminal and Convicted Hacker
By the time the authorities got their hands on him in 2013, Hieu had been hacking and stealing identity information for six years — and was ultimately undone after the US Secret Service tricked him into travelling from his native Vietnam, promising a meeting with someone who promised to deliver a large amount of consumer data for him to sell online.
“I just got grabbed,” he recalled, “and I felt like my life was over. The game I was playing had come to the end, and it’s game over.”
Black days, white hat
As happens with so many hackers, getting caught was a wake-up call for Hieu, whose interest in hacking grew steadily throughout his teenage years — including increasingly common visits to a local Internet café where he became embroiled in underground dark web forums.
“At first I just started having fun trying to deface those websites that I hacked into,” he recalls, “and I would steal information and share it. But it got more serious when I got into high school.”
Among the fallout from his crimes was the filing of false tax returns relating to 13,673 US citizens, whose personal information he sold to hackers that went on to fraudulently claim $65 million.
Casual and ongoing success emboldened him to continue his criminal activity — until a 15-year sentence inside a US prison gave him time to appreciate the magnitude of what he had done.
“I feel ashamed to talk about it because I know I have hurt and harmed so many peoples’ lives in America,” Hieu said.
His incarceration was particularly hard for his father, who “was so depressed when I got locked up” and started drinking extensively, Hieu said, before ultimately being diagnosed with Stage 4 cancer.
In the midst of his despair, Hieu admitted, “I tried to hang myself… to get it over with. But then I was thinking about my loved ones in Vietnam, and all the people who care for me — and I had to try again, and to be better, and show him through my actions that I had changed.”
“It was the only choice.”
Hieu was ultimately released from prison after serving five years — just months before the COVID pandemic sent him back into isolation — and committed himself to putting his days as a cybercriminal behind him.
He worked with US government authorities to share information about his dark web activities, and has been spending his time working to educate the public about cybersecurity and the activities of black-hat cybercriminals.
In an ironic twist of fate, Hieu now works as a cybersecurity specialist at Vietnam’s National Cyber Security Center, where he spends his time on threat hunting and targeting malicious actors working to steal people’s identities.
“I’ve already stopped at least 6,000 malicious domains trying to phish and scam people,” he says, adding that going straight has proven to be beneficial in more ways than he would have imagined at the time.
“To be honest, to be a white hat is a lot better,” he says. “I feel more confident. I don’t have to look behind my back. And I can sleep better.”
And the ill-gotten millions?
“At one point I was trying to give back the money that I earned during my cybercriminal activities,” Hieu said, “but then the prosecutor said it didn’t mean much and that the US government didn’t really need this money. They just wanted me to help and support them.”
So where did it go?
“I still have a little bit,” he admitted. “But most of the money went to the pockets of the lawyers.”
– David Braue is an award-winning technology writer based in Melbourne, Australia.
Go here to read all of David’s Cybercrime Magazine articles.
