This Hacker Stole Data From 200M Americans. Now He’s Infiltrating Scam Gangs.

In July 2015, the 25-year-old was sentenced to 13 years in prison for stealing personal information from approximately 200 million Americans—over 60 percent of the U.S. population—and selling it on the dark web. 

That day in court, the judge told him that they had received some 10,000 complaint letters from his victims. Among them was a woman who had lost her house and was struggling to feed her children after her personal information was hijacked by malicious actors, landing her in crippling debt.

It was then that the gravity of what he had done dawned on him. 

"I felt like a serial killer," he told VICE World News. “When I was still making money and living a good life in Vietnam, I thought that information was just numbers.”

“I couldn't imagine that stealing U.S. identities would bring so much damage to a person's life.”

Today, his life is unrecognizable from that of the prolific hacker he was 10 years ago. After a seven-year stint in U.S. federal prison, the 33-year-old today is still trawling the dark web, but now working for the Vietnamese government to hunt cybercriminals like he once was. As part of this grand redemption arc, the past year has also seen him tackling a disturbing new breed of cyber scammer in Cambodia, where thousands of human trafficking victims are trapped and tortured in industrial-scale centers, forced to lure internet users into online frauds. 

Fueling these attempts to make amends is the nagging guilt over his crime spree, described by U.S. authorities as one of the most prolific identity thefts in U.S. history, which he says continues to haunt many of his victims today.

“Every time I have a chance to speak with the media, I always try to apologize to American people as much as possible,” Hieu said. “Because I know the damage is already done and it's very difficult to recover when your identity gets traded or sold to bad people on the dark web.”

“It was so cool. You can crack into a system, you can get information. It’s kind of like you have the power to control the world,” he said. 

What started as a curiosity soon veered into criminality, as the teenager started selling stolen credit card information on the dark web. Despite making several resolutions to quit hacking over the years, he found himself sucked back in each time. 

By 2011, he was hacking into companies’ consumer databases and selling stolen U.S. identities—personal details like names, addresses, social security numbers, and bank account numbers—to strangers on the dark web. These details were later used by other hackers to apply for bank loans and credit cards, and according to the U.S. Internal Revenue Service, $65 million in fraudulent individual income tax returns were claimed using the identities of over 13,000 U.S. citizens.

According to the U.S. Secret Service agent who tracked Hieu down in 2013, Hieu had sold these identities to anyone who would buy it, for “pennies apiece.”

“I don’t know of any other cybercriminal who has caused more material financial harm to more Americans than [Hieu],” he told KrebsOnSecurity, a blog about computer security. 

By the time the United States Secret Service clamped down on his operation, Hieu was raking in over $100,000 a month, and had acquired a taste for luxury cars, five-star hotel vacations, and expensive restaurants. According to prosecutors, Hieu had made about $2 million from his scheme.

“Suddenly everything shut down,” he said. “I went down like the Titanic. A month I was making maybe a maximum of $5,000. And I was struggling.”

It was a lapse of judgment that put Hieu in the hands of U.S. authorities. He was arrested in 2013 after being lured to the Pacific island of Guam by a fellow hacker proposing they work together. The man was a cybercriminal cooperating with authorities for a reduced sentence, and the Secret Service detained Hieu once he landed. 

“When I got caught, and then I found out Guam is a U.S. territory, it was like game over,” he said. “They told me that they know more about me than my family knows.

While treating his family to expensive vacations and meals using stolen money, they thought that he was working as a web developer for a U.S. firm—including his sister, who was six months pregnant when she accompanied Hieu to Guam to help with translations, witnessing his arrest.

“Until now, I can’t forget her face and her tears,” he said. 

Hieu, who was released from prison in 2019, says many of the identities he had stolen 10 years ago remain in circulation, a grim reminder of the irreversible damage he has done to his victims. 

“When I got home, I did some research. Many of the old identities that I sold to the hackers back in the day were still there. It was still getting sold on the dark web,” he said. “When a person loses their identity, they lose it forever.”

But along with targeting more traditional modes of cybercrime—hacking, identity theft, phishing scams—Hieu has since found himself an unlikely participant in a humanitarian crisis unfolding in Southeast Asia. Over the past 18 months, reports have emerged of rampant human trafficking and abuses in industrial-scale scam operations that have proliferated across Myanmar, Laos and, most infamously, Cambodia, since the start of the pandemic. 

A VICE World News investigation in July found that the industry was likely responsible for the theft of billions of dollars each year using a workforce of tens of thousands. The criminal syndicates operating these scams target workers from countries like China, Taiwan, Malaysia and more recently Vietnam, luring them under false promises of well-paid customer service jobs. Under threat of violence, these victims are forced to work long hours scamming unsuspecting internet users using various cyber frauds.

Last year, Hieu launched ChongLuaDao, a nonprofit initiative that aims to tackle phishing scams in Vietnam. The project, which was recently integrated into Twitter, has seen Hieu and a team of over 20 cybersecurity experts blacklisting almost 9,000 malicious domains used to scam money or steal personal information. He has also been gathering information on scam syndicates in Cambodia, including evidence of abuse, financial records, their organizational structures, and the types of scams they commit—ranging from investment scams to fake e-commerce websites and online gambling.

“When I got back home [from prison], I wondered why there were so many fake and scam websites in Vietnam, and where they came from,” he said. “I did lots of research, investigating. I gathered all the information. And then I found out this is not a joke. This is something very serious.”

He hacked into scam operations last year, hoping to find out more about their inner workings after being contacted by victims asking for help. What he found in those computers left him shaken. 

“I have so many pictures and videos [of people being abused] that if I showed you, you wouldn’t be able to sleep,” he said.

Hieu’s descriptions of the violence occurring within the scam centers are part of a larger chorus of testimonies from those who have escaped in recent months. That includes Milo, a 24-year-old Vietnamese man who finally returned home last week after being trapped in Cambodia for more than a year. VICE World News has given him a pseudonym to protect his identity. 

At Milo’s operation—which ran online gambling scams out of a converted apartment block in the Cambodian town of Kampot—those who didn’t meet their monthly “sales target” of 300 million Vietnamese dong ($12,700) were punished with tasers, brutally beaten, and forced to work up to 17 hours a day.

“With big mistakes, they would make all the staff kneel for the whole day, from early morning till late at night. Or they would put them in a dark room and pull out their nails,” he said. “We didn’t have freedom and they could do whatever to punish us.”

With hundreds of Vietnamese and Chinese workers in his building, Milo said the operation, run by Chinese bosses at the very top, was making in the region of 60 billion dong per month, the equivalent of $2.5 million. 

Governments across Asia have been warning their citizens to steer clear of suspicious foreign job offers promising high wages, while the Cambodian government has recently begun showing signs of taking the issue seriously as the industry threatens the country’s reputation.

But there are thousands already trapped inside scam centers that remain helpless. Milo said that he attempted to reach Cambodian police and the Vietnamese embassy for help with no luck. After more than a year, he saved up 80 million dong ($3,400) to pay his own ransom in order to leave. Milo, an orphan from a young age lured by the prospect of earning a good wage, paid the entirety of the money he had saved during his time in Cambodia to be freed.

There are others who resort to more desperate attempts to escape. In August, about 40 Vietnamese staged a daring escape from a casino on the border in eastern Cambodia, host to a scam operation according to escapees, swimming across a river back to Vietnam. While most made it to safety, one worker drowned and another was recaptured by the casino owners. 

Attention on the issue is rising in Vietnam, but Milo is still concerned that there are plenty of Vietnamese still being duped into going to Cambodia.

“I'm really worried that they will hire more Vietnamese that don't know about the job to go to Cambodia and continue to manipulate them, to make them scam Vietnamese people,” he said. 

An NGO source working close to the issue in Vietnam told VICE World News that the pace at which the issue has emerged has been shocking. 

“The rapid evolution of this form of human trafficking has been deeply disturbing,” they said, requesting anonymity due to fears of impacting their work. “Just 18 months ago, these scam centers using forced labor were almost unheard of, and now they are a major threat to people's safety.”

Hieu says it would take more than just his efforts infiltrating these gangs to bring down the twisted multibillion-dollar industry which he describes as “unstoppable.” By his estimation, each scam website—among the thousands that he found—is making about $100,000 a day.

But even as one of Vietnam’s most skilled hackers, now committed to tackling these illegal operations, Hieu has seen enough to know the mammoth task in bringing them down.

“To be honest, I cannot solve this problem by myself because it’s very dangerous,” he said. “There are thousands of Vietnamese people still there.”

“Some people may never get home.”

Additional reporting by Alastair McCready.

Follow Koh Ewe on Twitter and Instagram.