HIEUPC▊
A teenager in Vietnam talked his way into the databases of the biggest identity brokers on the planet — including, for nine months, a subsidiary of Experian itself — and wholesaled the private records of more than 200 million Americans for about a dollar a head. A Secret Service agent would later say no other convicted cybercriminal caused more financial harm to more Americans. The agent lured him to Guam with a fake partner and a promise of more data; Ngo, "blinded by greed," got on the plane and was arrested stepping off it. Then the twist troll.fan lives for: he pleaded out, helped agents impersonate him to catch twenty of his own customers, did more than seven years, got deported — and came home a cybersecurity guy who tells kids not to become him. The confession is his own, on the record, to the reporter whose story first got him caught.
- WHO
- Hieu Minh Ngo — "Hieupc," "HieuPC"; b. ~1990, Vietnamese national, operated from Vietnam FACT
- SCENE
- Proprietor of the "fullz" identity shops superget[.]info, usearching[.]info and findget[.]me, powered by access hacked or social-engineered out of U.S. data brokers MicroBilt, Court Ventures (an Experian subsidiary) and TLO
- THE DRAMA
- A 2013 Secret Service sting: agents ran a convicted cybercriminal in the U.K. as a fake partner, dangled "the mother of all data caches," and lured Ngo to Guam — U.S. soil — where he was arrested off the plane. Then the redemption arc almost nobody in the scene gets
- RECORD
- Made roughly $3 million; his services sold data on 200M+ Americans. Pleaded guilty in New Jersey and New Hampshire; on July 14, 2015 sentenced to 13 years in U.S. federal prison. Cooperation cut it from a possible 24 FACT
- STATUS
- SERVED 7+ YEARS · DEPORTED 2020 — now, by his own account and the record, a cybersecurity professional in Vietnam who owns the conviction publicly
Most of the scene's identity-fraud legends were card thieves — loud, prolific, eventually famous. Ngo was quieter and, per the agent who caught him, worse: not stolen cards that die after a swipe or two, but whole identities that could be reused for years. This file is the rarest shape in the archive — the one where the subject is caught cold, cooperates, does hard time, and then narrates the whole thing himself, remorse included, to the reporter who first exposed him. Every beat below is from that confession and the federal court record.
the drama timeline
ACT I — THE RISE (2010–2013)
A middle-class kid with a computer discovers that selling people is safer than selling their cards — then talks his way inside the companies that hold everyone's file.
-
2010–11
Hacking for fun becomes hacking for profit
By his own account, Ngo studies in New Zealand, finds a payment-card hole in the university's network, and — when nobody fixes it — starts stealing cards to buy and resell event tickets. His visa lapses, he goes home to Vietnam, and drifts full-time onto hacking forums. Friends warn that cards and bank data are dangerous; identities, he decides, feel safer. "I went from hacking for fun to hacking for profits when I saw how easy it was to make money stealing customer databases," he told Krebs. His first big target: New Jersey consumer-reporting firm MicroBilt, whose systems he later admitted living inside "for almost a year."
-
2011–12
A dollar a head
Ngo stands up superget[.]info, selling "fullz" lookups — name, date of birth, Social Security number, address — on ordinary Americans. When MicroBilt kicks him out, he weasels into Court Ventures, posing with forged documents as a U.S.-based private investigator. "I just used some skill about social engineering and went through the security check," he said. Then the detail that made the case notorious: in March 2012 Experian bought Court Ventures, and for roughly nine more months Ngo kept his access — paying the credit bureau thousands a month by wire while reselling its data to identity thieves.
-
2012–13
Millionaire, blinded
After Experian shut him down, Ngo moved to another broker, TLO, and rebranded as usearching[.]info. By the government's account his services drew some 1,400 regular customers and averaged 160,000 lookups a month against data on more than 200 million Americans; Ngo himself put his take at roughly $3 million. He told Krebs he spent it on "vacations and cars and a lot of other stupid stuff," and paid off family debts — telling his parents the money came from building websites.
ACT II — THE STING (2013)
The Secret Service can't reach him in Vietnam. So they build him a fake friend and a fake problem, and let his own greed buy the plane ticket.
-
EARLY 2013
The fake partner
Working with the bureaus, agents shut Ngo's broker accounts one by one, then reached him through an intermediary in the U.K. — a real, convicted cybercriminal who agreed to play along. The story fed to Ngo: "Hey, you're treading on my turf, and I decided to lock you out. But as long as you're paying a vig through me, your access won't go away." Restore-your-empire bait, aimed squarely at a man who by his own admission had become obsessed with getting his data pipeline back.
-
FEB 2013
findget[.]me
The U.K. "partner" insisted on a face-to-face to make the arrangement permanent, and after months of pressure Ngo agreed to meet in Guam — which he knew was U.S. territory, and talked himself past anyway. "I was so desperate to have a stable database, and I got blinded by greed and started acting crazy without thinking," he said. "Lots of people told me 'Don't go!'" Agent Matt O'Neill's dry epitaph on the operation: one of Ngo's own services was called findget[.]me — "We took that seriously, and we did like he asked." He was arrested stepping off the plane.
ACT III — THE RECKONING (2013–2015)
He turns on his own customers, sits through the damage he did, and learns the human cost only in a courtroom.
-
2013–15
Pleas, and playing himself
Ngo pleaded guilty in New Jersey to hacking MicroBilt, and again in New Hampshire, where he testified against identity thieves who'd used his service — among them a serial tax-refund fraudster from Ohio. His cooperation led to 20 arrests, a dozen of them lured into the open by agents posing as Ngo on his own platform. The man who impersonated brokers to steal data spent his last free act watching the government impersonate him.
-
2015
The number, and the letters
The government estimated Ngo's services enabled roughly $1.1 billion in new-account fraud and about $64 million in tax-refund fraud; the IRS confirmed thousands of fraudulent returns filed using data his sites sold. But it was the mail that broke him: "During my case, the federal court received like 13,000 letters from victims who complained they lost their houses, jobs, or could no longer afford… because of me," he said. "That made me feel really bad, and I realized I'd been a terrible person."
-
JUL 14, 2015
Thirteen years
Ngo, then 25, was sentenced to 13 years in U.S. federal prison. He had faced more than 24; the sentence was cut because he cooperated. "From his home in Vietnam, Ngo used Internet marketplaces to offer for sale millions of stolen identities of U.S. citizens to more than a thousand cyber criminals scattered throughout the world," the Justice Department said — a case built, in part, off the very reporting that first named his shop.
ACT IV — THE TURN (2020–)
Time served, deported, and the ending the recidivism statistics say he shouldn't get — vouched for, of all people, by the agent who caught him.
-
2020
Home, and owning it
After more than seven years inside, Ngo was released and deported to Vietnam. In his final months he read everything he could on security and wrote a plain-language guide for ordinary people on avoiding identity theft; his LinkedIn, Krebs noted, states up front that he is a convicted cybercriminal. He says he wants to mentor young people away from the path he took. Even O'Neill — the agent who caught him — expects him to stay clean, while warning that a service like Ngo's would be more dangerous than ever today.
-
AUG 2020
The confession
Ngo contacted Krebs from a COVID-19 quarantine facility to tell his story on the record — a two-part first-person account of how he did it, what it cost, and why he wants others to stop. His closing line to the man whose 2011 post first got a Secret Service agent reading: "It's time for me to do something right, to give back to the world, because I know I can do something like this."
both sides, on the record
The record: a 13-year U.S. federal sentence after guilty pleas in two districts. Ngo admitted hacking and social-engineering his way into MicroBilt, Court Ventures (by then an Experian subsidiary) and TLO, and reselling "fullz" on more than 200 million Americans through superget[.]info, usearching[.]info and findget[.]me — for roughly $3 million in proceeds. He was caught in a Secret Service sting he walked into against every warning.
The harm was not hypothetical: by the government's estimate his services enabled some $1.1 billion in new-account fraud and about $64 million in tax-refund fraud, and the IRS confirmed thousands of fraudulent returns filed with data his sites sold. Agent Matt O'Neill's assessment — his, and stated as his — is that no other convicted cybercriminal caused more financial harm to more Americans.
He cooperated, hard: his testimony and undercover help led to 20 arrests, and his sentence was cut from a possible 24 years to 13 because of it [3].
The remorse is on the record: he says the 13,000 victim letters read to the court changed him — "I know now that what I was doing was just evil" — and he came home and wrote a public guide to help ordinary people avoid exactly what he did [2].
He owns it publicly: his LinkedIn states outright that he is a convicted cybercriminal, and he says he wants to steer young people away from the life. The agent who caught him believes he will stay clean [2].
YOU DECIDE
The crime is adjudicated — he pleaded to it, and did more than seven years. What's genuinely open is only the ending: whether the redemption is real or performance. Two things make this file unusual. First, the confession is voluntary and first-person, given to the reporter who first exposed him, with the remorse un-hedged. Second, the man best positioned to be cynical — the Secret Service agent who ran the sting — is the one who says he'll probably stay straight.
The archive does not sell absolution. It keeps the docket, the $3 million, and the 13,000 letters — and, in his own hand, the sentence that begins "I know now."
evidence locker
FIRST-PERSON CONFESSIONAL
KrebsOnSecurity — "Confessions of an ID Theft Kingpin, Part I" (Aug 26, 2020) ATTRIBUTED — Ngo's first-person account of the New Zealand start, the turn to selling identities, MicroBilt, the Court Ventures social-engineering and Experian access, the ~$3M, and the Guam lure; plus agent Matt O'Neill's assessment.
krebsonsecurity.com/2020/08/confessions-of-an-id-theft-kingpin-part-i/ KrebsOnSecurity — "Confessions of an ID Theft Kingpin, Part II" (Aug 27, 2020) ATTRIBUTED — the pleas, the 20 arrests, the $1.1B / ~$64M government estimate, the 13,000 victim letters, and Ngo's remorse and reform in his own words ("just evil"; the LinkedIn disclosure; the mentoring intent).
krebsonsecurity.com/2020/08/confessions-of-an-id-theft-kingpin-part-ii/
CONTEMPORANEOUS REPORTING
COURT RECORD
CROSS-LINKS
troll.fan — The Timeline CROSS-LINK — where the 2011–2020 arc (exposure, Guam sting, 13-year sentence, confession) sits in the scene's larger chronology.
troll.fan/timeline.html
The standard. Hieu Minh Ngo's arrest, guilty pleas, and 13-year federal sentence are court record, reported contemporaneously by Brian Krebs and stated in the DOJ release. The scale figures — $3 million in proceeds, data on 200M+ Americans, an estimated $1.1 billion in downstream new-account fraud and ~$64 million in tax fraud — are the government's and Secret Service agent Matt O'Neill's, and are attributed to them, not adopted as our own precise accounting. Ngo's remorse and reform are his own framing, from the first-person confessional he volunteered, and are carried at full strength — neither sanded nor inflated. No motive beyond the record is asserted, and no victim's personal data is reproduced; the focus is Ngo's own documented and admitted conduct. If a line here couldn't survive scrutiny, it wouldn't be on the page.