Three Men Charged in the Largest Email Hack 'In the History of the Internet'

UPDATE: David-Manuel Santos Da Silva, the Canadian arrested and charged with conspiracy to commit money laundering, has plead not guilty, according to court documents. His detention hearing will be held on March 17th and the case is ongoing. 

​The US Department of Justice announced today that it has charged three men for participating in what officials are calling "one of the largest reported data breaches in US history" and "the largest data breach of names and email addresses in the history of the Internet."

According to a Department of Justice statement, two of the men—Viet Quoc Nguyen and Giang Hoang Vu, both Vietnamese citizens living in the Netherlands—hacked into the networks of eight email service providers across the US and "allegedly made millions of dollars by stealing over a billion email addresses from email service providers."

Vu was arrested in March of 2014 and pleaded guilty to conspiracy to commit computer fraud on February 5th, 2015. Nguyen is currently on the run from the law.

The third man, a Canadian named David-Manuel Santos Da Silva, was indicted on Wednesday to conspiracy to commit money laundering. His role in the scam was more tangential: Da Silva enlisted Nguyen and Vu's services as marketers. The pair spammed email inboxes using addresses they obtained through hacks, driving traffic to sites that promoted products marketed by Da Silva's now defunct marketing site, Marketbay. Nguyen and Vu got a cut of whatever money Da Silva made on sales from this activity.

"Between approximately May 2009 and October 2011, Nguyen and Da Silva received approximately $2 million for the sale of products derived from Nguyen's affiliate marketing activities," the Department of Justice statement reads.

The scam went down in 2011, and all three men were arrested and pleaded guilty at different times (Nguyen notwithstanding, since he ran for it—literally), but it wasn't until today that the indictment was "unsealed," or made public, by the Department of Justice.

While the US government hasn't named the specific victims of the hacks, security researcher Brian Krebs posted today that all the signs point to email marketing firm Epsilon. According to the Department of Justice statement, "the data breach into certain ESPs [email service providers] was the subject of a congressional inquiry and testimony before a U.S House of Representatives subcommittee on June 2, 2011." Krebs notes that this date coincides with a House Energy and Commerce Committee panel on hacks against Sony and Epsilon.

Da Silva's arraignment began at 3 PM today, and is currently ongoing. There is no word yet on his plea. We will update this post when we receive more information.

While Vu pleaded guilty, it's worth noting for the other two that an indictment is just an accusation until proven true in a court of law. The ultimate fate of the three men from across the world who entered into such a weird arrangement to make millions through hacks and scams is far from certain, although with one guilty plea already in, it's not looking good.​