Email data hack in U.S. leads to arrest of Montreal man

A Canadian man has been accused of helping two Vietnamese citizens hack email service providers south of the border, the U.S. Department of Justice says.

The email hacking was one of the largest reported data breaches in U.S. history, the Department of Justice said in a statement released Friday.

David-Manuel Santos Da Silva of Montreal, 33, was recently indicted by a federal grand jury for aiding Viet Quoc Nguyen, 28, and Giang Hoang Vu, 25, who were operating in the Netherlands, "to generate revenue from the computer intrusions and data thefts."

The largest data breach of names and email addresses in the history of the internet.- U.S. Department of Justice

According to the statement, Nguyen and Vu were accused of stealing confidential information from at least eight email service providers in the U.S. between February 2009 and June 2012, and used it to send spam emails to "tens of millions of email recipients."

"These men — operating from Vietnam, the Netherlands, and Canada — are accused of carrying out the largest data breach of names and email addresses in the history of the internet," said the Department of Justice's assistant attorney General Caldwell.

It is alleged that Vu and Nguyen used the stolen information to send spam emails that included hyperlinks to pages selling products on Marketbay.com, a website co-owned by Da Silva.

Authorities said the case is significant because of the scale of the information stolen. John Horn, the acting U.S. attorney based in Atlanta, said hackers targeted marketing companies that send bulk emails to customers of their commercial clients. ​

The hackers not only stole hundreds of millions of email addresses, but they also succeeded in using the marketing firms' own systems to send spam messages.

Between 2009 and 2011, U.S. officials claim Nguyen and Da Silva made approximately $2.5 million from sales generated by people clicking links on the spam emails.

That means the defendants would have averaged a fraction of a penny for each of the stolen email addresses.

Vu was arrested by Dutch law enforcement in 2012 and extradited to the U.S. in March 2014. Has has since pleaded guilty to conspiracy to commit computer fraud. He has not yet been sentenced. Nguyen remains a fugitive.

Da Silva was arrested in Fort Lauderdale, Fla., on Feb. 12 and is scheduled to be arraigned Friday in Atlanta.