📸 Photo

MAKSIK

from the Post Street Towers, but Max could afford it—he could pay a month's rent with a couple of good days of dumps vending. As Digits, Max was now regarded by some carders as the second-most-successful magstripe vendor in the world.

The number one spot was firmly occupied by a Ukrainian known as Maksik. Maksik operated outside the carding forums, running his own Web-based dispensary for his stolen cards at Maksik.cc. Buyers would begin by sending Maksik upfront money by e-gold, WebMoney, wire transfer, or Western Union. That would buy them access to his website, where they could select the dumps they wanted by BIN and type of card and place an order. On his end, Maksik would press a button to approve the transaction, and the buyer would get an e-mail with the dumps he'd ordered, straight from Maksik's massive database of stolen cards.

Maksik's wares were phenomenal, with a high success rate at the register and a mammoth selection of BINs. Like Max's, Maksik's cards came from swipes at point-of-sale terminals. But instead of targeting scores of small stores and restaurants, Maksik got his cards from a smaller number of giant targets: Polo Ralph Lauren in 2004; Office Max in 2005. In three months, Discount Shoe Warehouse lost 1.4 million cards taken from 108 stores in 25 states—straight into Maksik's database. In July 2005, a record-breaking 45.6 million dumps were stolen from the TJX-owned retail chains T. J. Maxx, Marshalls, and HomeGoods.

There was a time when such breaches might have remained a secret between the hackers, the companies, and federal law enforcement—with the victim consumers kept in the dark. To encourage companies to report breaches, some FBI agents had an unofficial policy of keeping company names out of indictments and press releases, protecting corporations from bad publicity over their shoddy security. In the 1997 Carlos Salgado Jr. case—the first large-scale online credit card heist—the government persuaded the sentencing judge to permanently seal the court transcripts, for fear the targeted company would suffer “loss of business due to the