Darknet Diaries
These 8 Companies You've Never Heard Of Sell Your Personal Data to the Cops Ep. 162: Hieu
Episode Summary
AI-generated · Mar 2026AI-generated summary — may contain inaccuracies. Not a substitute for the full episode or professional advice.
Hieu Minh Ngo, a Vietnamese hacker, shares his remarkable journey from a curious teenager stealing internet dial-up accounts to a sophisticated cybercriminal, and his eventual transformation into a cybercrime fighter. This episode delves into his ventures hacking e-commerce sites for credit card data, then building a "people search engine" that sold millions of US identities to other criminals. Host Jack Rhysider critically examines the controversial landscape of data brokers, questioning their pervasive, often hidden, collection and sale of personal data, and argues against the severe application of the Computer Fraud and Abuse Act (CFAA) in Hieu's case.
The episode details Hieu's early life in Vietnam, where he began hacking at 14 out of curiosity, progressing to stealing credit card information from vulnerable e-commerce websites and laundering money through online poker sites via "chip dumping" [12:42]. He sold Visa and Mastercard details for as little as "fifty cents for one information" due to the sheer volume he obtained [15:51]. After a close call with New Zealand police for buying concert tickets with stolen cards, Hieu was advised by other hackers that stealing US identities would be "safer" and less pursued by law enforcement [25:20]. This led him to target US data brokers.
Jack Rhysider provides an in-depth explanation of data brokers, revealing how they legally compile vast amounts of personal data from public records, social media, phone trackers, and purchasing histories, then sell it to law enforcement, marketers, and insurance companies [27:30]. Hieu successfully hacked into LocatePLUS and MicroBilt using techniques like SQL injection, file upload, and cross-site scripting, eventually impersonating a private investigator to gain official API access to Court Ventures, a data broker holding "almost 200 million US identity" records [34:46], [46:10]. His website, operating on the clear web, charged $1 per search, generating over $120,000 USD monthly while paying Court Ventures up to $35,000 USD, accumulating over $2.5 million in profit [47:11].
Hieu was eventually lured to Guam by the US Secret Service [60:57] and arrested, learning only later that his site facilitated "tax returns" fraud, causing over "$60 million USD" in damages to US citizens, particularly in New Hampshire [65:07], [66:10], [71:33]. Jack strongly critiques the CFAA, under which Hieu was charged for "unauthorized access" (violating terms of service) [67:15], comparing it to the Aaron Swartz case [69:21]. He highlights the irony of prosecuting Hieu for reselling data he paid for from data brokers who legally collect and sell identities, and notes that data brokers like Court Ventures and MicroBilt never publicly disclosed their breaches or notified affected individuals [79:03]. After serving seven years of a thirteen-year sentence, Hieu was released and now works for the Vietnamese government, fighting cybercrime and aiding victims, expressing deep remorse for his past actions [89:44], [90:45], [91:46].
Listeners will walk away with a stark awareness of the legal ambiguities and ethical concerns surrounding data brokering, the potential misapplication of cybercrime laws, and the profound implications for personal privacy in the digital age. The episode challenges the perception of who constitutes a "victim" or "criminal" in the complex world of data exploitation.
👤 Who Should Listen
- Anyone concerned about digital privacy and the commercialization of their personal data.
- Cybersecurity professionals interested in the history of darknet operations and data breaches.
- Individuals wanting to understand the legal and ethical complexities surrounding data brokers and privacy laws.
- Listeners interested in true crime stories involving international cyber fraud and the journey of a reformed hacker.
- Those curious about the application and impact of the CFAA (Computer Fraud and Abuse Act) and its implications for online behavior.
- Victims of identity theft or tax fraud seeking to understand how their data might be exploited and the systemic vulnerabilities involved.
🔑 Key Takeaways
- 1.Hieu Minh Ngo, a Vietnamese hacker, transitioned from stealing internet accounts and credit cards to building a "people search engine" that sold US citizens' personal data to cybercriminals on the clear web [38:54].
- 2.Hieu gained API access to data broker Court Ventures by impersonating a private investigator, which gave him access to "almost 200 million US identity" records, making over $2.5 million in profit from reselling searches [46:10], [47:11].
- 3.The US Secret Service lured Hieu to Guam and arrested him after discovering his site enabled criminals to commit "tax returns" fraud, causing over "$60 million USD" in damages, particularly in New Hampshire [60:57], [65:07], [66:10], [71:33].
- 4.Hieu was charged with three violations of the CFAA (Computer Fraud and Abuse Act) for "unauthorized access" by violating a data broker's terms of service, which host Jack Rhysider argues is an overly broad application of federal law [67:15], [68:18].
- 5.Data brokers legally collect vast amounts of personal data from public records, social media, phone trackers, and purchasing history, selling it to entities like law enforcement and marketers without widespread public knowledge or consent [27:30], [29:31], [32:39].
- 6.Jack Rhysider criticizes data brokers for their lack of transparency, failure to protect data from breaches (Hieu successfully hacked four companies), and not notifying victims when their data is compromised, despite operating legally [79:03], [86:27].
- 7.After serving seven years of a thirteen-year sentence, Hieu was released in 2020 and now works with the Vietnamese government, helping law enforcement catch cybercriminals and assisting scam victims, expressing remorse for his past actions [89:44], [90:45], [91:46].
- 8.The IRS annually loses "billions of dollars" to tax refund scams, highlighting a significant vulnerability in government financial systems that criminals exploit [67:15].
💡 Key Concepts Explained
Data Broker
Companies that gather vast amounts of information about individuals from various sources (public records, social media, phone trackers, purchasing history) and compile it into profiles to sell to other businesses, law enforcement, and government agencies [27:30]. This episode highlights their pervasive, often hidden, operations and the ethical dilemmas surrounding their legal status, as Hieu Minh Ngo exploited and later impersonated users of such services.
Computer Fraud and Abuse Act (CFAA)
A US federal law that criminalizes unauthorized access to computer systems [67:15]. The episode critiques its broad application, particularly how it's used to prosecute individuals for violating website terms of service, arguing it disproportionately punishes such actions as federal crimes rather than civil issues, referencing the tragic case of Aaron Swartz [69:21].
Chip Dumping
A money laundering technique where stolen funds are deposited into an online gambling account, and then the account owner intentionally loses hands to an accomplice's account at a poker table [13:46]. The accomplice then cashes out the "won" chips, effectively laundering the stolen money into legitimate cash, as Hieu and his partner did with stolen credit card funds.
Third-Party Doctrine
A legal principle in the US that states individuals have no reasonable expectation of privacy in information they voluntarily share with third parties, such as banks or app developers [30:34]. Law enforcement can often access this data without a warrant because it's considered "commercially available," bypassing Fourth Amendment protections against unreasonable searches and seizures.
⚡ Actionable Takeaways
- →Be skeptical of apps and websites that ask for excessive permissions, as they may be collecting and selling your real-time location and other private data to data brokers [28:31], [85:24].
- →Review your digital footprint and privacy settings on social media and other online accounts, as data brokers scrape this information from publicly available sources [27:30].
- →Understand the implications of the "third-party doctrine" on your data, recognizing that information shared with banks or other services might be accessible to the government without a warrant [30:34].
- →Advocate for stronger data privacy laws and reforms to acts like the CFAA, which can penalize terms-of-service violations with federal prison time [69:21].
- →Research data brokers mentioned in the episode (e.g., Merkle, LocatePLUS, MicroBilt, Court Ventures) to understand their data collection practices and potential impact on your privacy [33:40].
⏱ Timeline Breakdown
💬 Notable Quotes
“"We know about you. We know everything about you, maybe more than your family knows about you." [61:59]”
“"I feel like I owe a lot to the people, basically the people in the US. I — kinda like I hurt and harmed so many people’s lives, and I kinda always feel ashamed about it." [91:46]”
“"They say if you don’t pay for it, then you're the product. But what if you pay a data broker to look up your own data? What then, hm?" [92:48]”
“"I was on top of the world, and right now I was living in hell." [61:59]”
More from this guest
Hieu Minh Ngo
📚 Books Mentioned
Listen to Full Episode
📬 Get weekly summaries like this one
No spam. Unsubscribe anytime. By subscribing you agree to our Privacy Policy.
Continue Exploring
