Ngo Minh Hieu (also known as Hieu PC; born October 8, 1989) is a Vietnamesecyber security specialist and a former hacker and identity thief.He was convicted in the United States of stealing millions of people's personally identifiable information and in 2015 he was sentenced to 13 years in U.S. federal prison.After his early release from prison in 2020, Hieu returned to Vietnam and was recruited by the National Cyber Security Centre (NCSC) under the Ministry of Information and Communications as a technical expert.[2][3] Currently, he holds the positions of director of the sociallimited liability companyChongLuaDao and manager of the non-profit project ChongLuaDao, which he co-founded with his partners at the end of 2020.[4]
Hacker
The crime and its beginning
Ngo Minh Hieu is a Vietnamese.[5] He was born in Gia Lai, Vietnam, on October 8, 1989.
In his late teens, he went to New Zealand and aimed to become a network expert.By that time, he was already an administrator of several dark web hacker forums. He discovered vulnerability in the school’s network that can be exploited to steal credit card and bank accounts information. “I did contact the IT technician, but they don't care, so I hacked the whole system,” Hieu recalled. “Then I took advantage of the same vulnerability to hack other websites. I stole lots of information.” Hieu used the card data to buy concert and event tickets from Ticketmaster, then sold tickets at TradeMe.The university became aware of his act, the Auckland police got involved.[1] Hieu’s travel visa was not renewed after the first semester ended, and in retribution, he attacked the university’s site, shutting it down for at least two days.[1]
From 2007 to 2013, he operated a "massive international hacking and identity theft scheme from his home in Vietnam," in which he stole personally identifiable information (such as names, Social Security numbers, and bank account data) of 200 million U.S. citizens.[6] Hieu obtained this data by hacking companies' databases, then advertised and offered (on two websites he operated, which were later shuttered) the stolen information for purchase by other cybercriminals.[7] Hieu was also able to obtain data from Court Ventures, an Experian subsidiary,[8][9] by "posing as a private investigator operating out of Singapore."
Hieu made nearly $2 million from his scheme.[5][6][10] The Internal Revenue Service has confirmed that 13,673 U.S. citizens, whose stolen PII was sold on Hieu’s websites, have been victimized through the filing of $65 million in fraudulent individual income tax returns.[11]
Prosecution, sentence, and release
In February 2013, Hieu entered the United States territory and was arrested[6] after U.S. Secret Service investigators lured Hieu to Guam "to consummate a business deal with a man he believed could deliver huge volumes of consumers' personal and financial data for resale."[12] He subsequently pleaded guilty to federal crimes: (1) wire fraud, (2) identity fraud, (3) access device fraud, and (4) four counts of computer fraud and abuse.Hieu had been facing more than 42 years in federal prison,[13] but his sentence was lightened because he cooperated with investigators to secure the arrest of at least a dozen of his U.S.-based customers.[14][15]
The Secret Service had difficulty pinning down the exact amount of financial damage inflicted by Hieu’s various ID theft services over the years, primarily because those services only kept records of what customers searched for, not which records they purchased. But based on the records they did have, the government estimated that Hieu’s service enabled approximately $1.1 billion in new account fraud at banks and retailers throughout the United States, and roughly $65 million in tax refund fraud with the states and the IRS.[16]
In July 2015, U.S. District Judge Paul Barbadoro sentenced Hieu, then age 25, to 13 years in prison.[5][6]The Bureau of Prisons lists his register number as 03664-093, and his release date was 11/20/2019. In the final months of his detention, Hieu started reading everything he could get his hands on about computer and Internet security and even authored a lengthy guide written for the average Internet user with advice about how to avoid getting hacked or becoming the victim of identity theft. In the longer term, Hieu says, he wants to mentor young people and help guide them on the right path, and away from cybercrime. He’s been brutally honest about his crimes and the destruction he’s caused. His LinkedIn profile states up front that he’s a convicted cybercriminal.Hieu was described by the US government as "one of the most notorious thieves ever to grace a federal prison".[17][18]
Cybersecurity specialist
Three months after his return to Vietnam, Hieu posted a photo of his application for the National Cyber Security Monitoring Center (NCSC) on his personal Facebook page on December 3, 2020.[19] The next day, a representative of NCSC officially confirmed that Hieu would work for them as a technical expert.[20] Less than a month after officially starting work for NCSC, Hieu PC publicly demolished two bogus websites, disguised as Vietnam Airlines and Vietjet Air booking services, designed to defraud passengers.[21][22] These two sizable fake websites, which have been around for a while, are regarded as sizable fake websites.Hieu PC's decision to publicly knock both down gained attention and received backing from online users.[23] Additionally, he removed profiles on social media that were created in his name with the intention of stealing consumers' confidence and making money.[24]
In light of the numerous scams that have recently cropped up and are causing Vietnamese users a great deal of harm, including impersonation scams,[25][26]malwares disguising themselves as free applications,[27][28][29] illegal virtual currency trading,[30] etc. Hieu frequently makes appearances in campaigns against these scams, as well as providing users with advice and warnings.[31] These scams include targeted attacks on business systems,[32]
From "black hat",[44] Ngo Minh Hieu turned "white hat" after returning to Vietnam.[45] He is continually awarded by several technological businesses as well as cellular service providers for his efforts in finding and correcting security issues.In May 2022, he was honored by Apple Inc. as one of the security specialists who contributed to this firm by identifying security weaknesses in Apple web servers.[46][47] This is the first time he has been awarded in the capacity of "white hat".[48] In February 2023, he was handed a certificate by the US carrier Verizon to congratulate him for uncovering two vulnerabilities that might damage data and two faults connected to the web management system of their network.[49][50]
In March 2023, he was invited to Dubai to attend and give a lecture on cybersecurity at the Gulf Information Security Expo & Conference (GISEC).[51][52] This is the first time he has gone overseas since returning to Vietnam at the end of 2020.[53] Currently, he is a member of the Information Security Board of the Vietnam Blockchain Association, which was launched on May 18, 2022.Additionally, he is the head of the Chaintracer Anti-Fraud Project, which is one of the association's four major initiatives for 2023.[54][55] This blockchain-based transaction monitoring initiative supports efforts to combat money laundering and the funding of terrorism.[56]
Social projects
In February 2021, he established the non-profit initiative "ChongLuaDao" together with the related website and add-on extension.[57][58] This is a project to alert clients about websites with undesirable material, false content, phishing, scams, or harboring malware.[59] After just one day of availability, the ChongLuaDao extension has received more than 3,500 downloads, more than 70 thousand views, and banned more than 1000 phishing websites from more than 1400 reports from users.[60] Since returning to Vietnam, he has regularly participated in providing knowledge about information security in cyberspace, helping users avoid harmful websites.[61][62] In addition, he has put up a blog called 7onez to help many individuals and companies enhance their knowledge of attacks from hackers.
Others activities
Besides humanitarian projects, Ngo Minh Hieu regularly appears in sharing sessions, discussion shows, seminars, or conferences on information security at home and abroad.
he flatly refuted these labels, asserting that he was simply a regular person and not the "super hacker" that many media outlets had made him out to be.
In December 2021, Meta collaborated with Hieu PC to release a series of films that addressed fraud prevention and guaranteeing consumers' safety when using the internet in Vietnam.
The videos are broadcast on the Meta Vietnam Facebook page and Hieu's personal page.
Both Hieu's personal page and the Meta Vietnam Facebook page are airing the videos.[42][43]
In a meeting with Lao Dong Newspaper, Ngo Minh Hieu remarked that there are often a lot of financial companies and banks that request his cooperation to figure out the system's security weaknesses.
He undertakes these works by contract, but 60% of his time is generally devoted to social projects.[49]
In May 2021, Ngo Minh Hieu and Coc Coc established the "Green Shield Campaign" with the purpose of providing a secure online environment for Vietnamese people.[65][66] This is quite a campaign that attracted the attention of the media and Vietnamese people during its start.[67][68][69] In less than 4 weeks, more than 24,000 hazardous websites have been reported by users, and more than 12,000 websites with harmful and phishing features have been warned.[70] This makes Hieu PC's cyber security project efforts attract greater attention.[71] During this time, he also took on the role of professional consultant for CyberKid Vietnam, a non-profit organization that supports children in cyberspace.[72][73] This is also a particular project that focuses on the protection of children, one of the most susceptible victims of cyberattacks.[74][75] In the context of the breakout of the COVID-19 pandemic in Vietnam, the issue of stealing personal information and scamming users is taking place more and more severely.[76][77] Hieu PC and his fanpage on the social network Facebook are presently one of the most noted information security channels when continuously updating preventative measures and associated warnings.[78][79]
The members of the ChongLuaDao initiative not only periodically issue warnings about the status and scams that are happening often,[80][81] but also offer remedies and help for victims of scammers.[82][83] On November 24, 2021, Ngo Minh Hieu announced the foundation of ChongLuaDao Company, a social enterpriseprivate limited company.This non-profit company is the next evolution of the non-profit project of the same name that launched in late 2020.[84] ChongLuaDao has partnered with a variety of domestic and international companies throughout its first three years of existence, including Anti-Phishing Working Group,[85] Kaspersky,[86]Cisco, Viettel, CyRadar,[87]Twitter,[88][89] the Law Library ,[90] VinCSS,[91][92] the Global Anti-Scam Alliance (GASA),[93] and Google Chrome.[94] Apart from being recognized as the Cyber Security Awareness Champion Organization by the National Cybersecurity Alliance for two consecutive years in 2022 and 2023,[95][96] ChongLuaDao has also been awarded two significant Vietnamese government honors: Made in Vietnam 2022 and Vietnam Talen Awards 2023.[97][98] By the time of the three-year anniversary celebration, ChongLuaDao's membership communities had reached 500,000 members on the Facebook platform and 25,000 members in the Telegram group, thereby helping to detect and handle more than 20,000 malicious websites.[99]
Cybersecurity startup
In 2022, Ngo Minh Hieu founded a project called CyPeace. This project assists individuals and businesses in understanding the origins and verifying the safety of websites and applications through expert analysis. Accompanying him is Pham Tien Manh, another member of Chong Lua Dao.Pham Tien Manh, also known as Manh Pham, with nicknames Bé Mây or ManhNho, is a cybersecurity expert who previously served as a security researcher for OWASP.He was recognized by Facebook as one of the top 100 security experts in 2019.[100] Like Hieu, Manh Pham has been continuously recognized by Apple Inc. for his contributions in identifying security vulnerabilities in Apple's web servers in March, June, September, and October of 2022.[101][102] He also developed a deepfake detection tool that was showcased at the BlackHat Asia 2023 security forum held in Singapore.[103]
In 2023, Ngo Minh Hieu and Manh Pham officially established a cybersecurity company named Cyberspace Peace Company Limited (CyPeace), with Manh Pham as the CEO and Ngo Minh Hieu as the co-founder. CyPeace operates with the philosophy "Cyber Peace of Mind," aiming to ensure internet information security for everyone. The company has initiated several projects with domestic and international partners, including collaborations with the National Innovation Center (NIC) under the Ministry of Planning and Investment. In March 2023, Ngo Minh Hieu represented CyPeace at the Gulf Information Security Expo & Conference (GISEC) in Dubai. In October of the same year, he and Manh Pham continued to represent the company at Gitex Global: Dubai 2023, the largest technology event of the year. At this event, CyPeace collaborated with Cookie Arena to organize a CTF workshop on the topic of Threat Hunting. In November, Ngo Minh Hieu again represented CyPeace at the Cyseex 2023 conference organized by the Cyseex Information Security Alliance, where CyPeace was also a co-sponsor.
In 2024, Ngo Minh Hieu and Manh Pham continued to represent CyPeace at various information security events such as Cybersecurity Talk hosted by SotaTek, the "Hacker Roadmap" talk show at FPT University Hanoi, and the event "Cybersecurity - A Shared Responsibility" organized by CIO Vietnam. At the end of May, Ngo Minh Hieu, as the co-founder of CyPeace, participated in the 6th Vietnam Security Summit organized by the Ministry of Information and Communications, the Information Security Department, and the IEC Group. At this conference, he presented on the topic "Mobile Device Security for Remote Work" in the context of remote work becoming an irreversible trend.
