Darknet Diaries – Episode 162: Hieu

Host: Jack Rhysider
Guest: Hugh Mingo (aka “Hieu”)
Date: August 5, 2025

Episode Overview

In this episode, Jack Rhysider interviews Hugh Mingo, a Vietnamese hacker turned cybercrime investigator, about his rise from a teenage hacker in rural Vietnam to one of the world’s most prolific sellers of stolen personal data, and ultimately his arrest and transformation. The episode exposes the shady underbelly of the online data broker industry, the mechanics and mindset of large-scale identity theft, and the troubling legal gray areas around data privacy and prosecution. Hieu’s story raises deeper questions about privacy, personal data, and the ethics of the information economy.

Key Discussion Points

1. Hieu’s Early Days in Vietnam (00:10 – 05:41)

• Hieu grew up in Cambran, Vietnam, developing an early fascination with computers and the internet.
• The prohibitive cost of internet access inspired him to hack and steal dial-up ISP accounts at age 14-15.
• “That’s one reason that I started to hack and steal a few Internet dial accounts to be able to use it without paying … my first time, I got into trouble when I was like 15 years old.” (00:10 – Hieu)
• After doing $5,000 in damage, his father sent him to Ho Chi Minh City for better schooling—and unintendedly, closer to the hacking underground.

2. Falling Into the Darknet (05:41 – 09:38)

• In Ho Chi Minh City, Hieu’s computer skills accelerated. An encounter in an internet café introduced him to Vietnam’s “dark web” forums:
  “The moment I’ve been there, I passed one of the computer screens … dark background … green color … this is about the dark web in Vietnam.” (05:58 – Hieu)
• He became obsessed with hacking forums, learning vulnerabilities, sharing techniques, and becoming known in the underground scene.

3. Transition from Hobbyist to Profiteer (09:38 – 18:16)

• Hieu started as a “for fun” hacker — exploiting poorly secured websites, leaving “pwned by HughPC” messages.
• A forum user convinced him hacking could be lucrative, leading to the monetization of his skills by stealing and selling credit card data from vulnerable e-commerce sites using tools like Google Dorking and SQL injection.
  “I put on the customized tool that I programmed … it will give me the list of vulnerable website and then I will exploit it to obtain the red account information.” (12:50 – Hieu)
• He laundered stolen card proceeds through online poker “chip dumping” schemes, earning thousands daily with partners, and began selling excess card data on hacking forums for as little as $0.50 per card.

4. Expanding Operations and Facing Consequences (18:16 – 25:49)

• Hieu’s activities scaled rapidly; he moved over 100,000 card data records and amassed substantial profits.
• Fearing legal consequences and realizing the risk, he used illicit funds to pay for school fees in New Zealand, attempting a “fresh start.”
• After a period of behaving, financial pressures drew him back into hacking—this time targeting local New Zealand e-commerce sites.
• His undoing came after using stolen cards to buy and resell concert tickets. Victims' complaints led to police scrutiny, prompting Hieu to flee back to Vietnam as a fugitive.

5. Entering the Mega-League: Data Brokers (27:20 – 39:26)

• Back in Vietnam and shamed by his family, Hieu tried to reform but was lured back by old acquaintances who suggested targeting U.S. data brokers—companies aggregating vast troves of personal information on Americans.
• He performed technical reconnaissance, hacking into brokers like LocatePlus and MicroBuilt via SQL injection and other web attacks.
• Armed with thousands of compromised investigator/law enforcement logins, he could look up nearly anyone’s full identity.

6. Building an Illicit Data Broker Business (39:26 – 55:49)

• Hieu set up a people-search site for cybercriminal clients, charging $1 per query (data cost him $0.14 via broker).
• Payments were handled using Liberty Reserve, an anonymous online currency favored by criminals.
• “The first week of him launching this website, he made $5,000 … was making more than $120k per month.” (42:17, 49:58 – Jack)
• He automated the business, handling millions of U.S. identities and earning over $3 million, while paying hundreds of thousands monthly to U.S. data brokers.
• At one point, he impersonated private investigators and used phishing and malware to gain legitimate broker access, maximizing data extraction.
• Most site users were cybercriminals, using the data for identity theft, fraud, and, as later discovered, mass tax refund scams.

7. The Experian Takeover and Secret Service Investigation (59:25 – 63:13)

• Court Ventures, a broker furnishing him API access, was acquired by Experian. The Secret Service tipped off Experian to the illicit resale, leading to a shutdown of Hieu’s access and a manhunt.
• Hieu tried alternate access methods, but Secret Service agents lured him to Guam with an offer of expanded API access.
• Upon arrival, he was arrested—“They told me, ‘We know everything about you, maybe more than your family does.’ … and that moment I say, man, it’s over.” (64:19 – Hieu)

8. The Prosecution and Legal Questions (67:02 – 86:04)

• Hieu faced three CFAA (Computer Fraud and Abuse Act) charges related to unauthorized access and profiting from data in excess of $5,000, plus alleged money laundering (never proven as his laundering was outside the U.S).
• His lawyer fees exhausted much of his fortune; prosecutors blamed him for $60 million in damages.
• “The only real thing here is … you’re saying, hey, I’m just doing an upcharge for this and giving you access to more people. It’s not really stolen data; it’s actually paying for the data as you’re using it.” (74:47 – Interviewer)
• Neither data brokers nor companies affected reported breaches or testified; court focused on CFAA violations and the connection to downstream identity theft and tax scams.
• Hieu ultimately pleaded guilty, receiving a 13-year sentence but served seven years for good behavior.

9. Reflections and Life After Prison (93:49 – 95:36)

• Hieu returned to Vietnam in 2020 with modest remaining assets and worked for the government’s cyber defense center.
• Now, he works combating cybercrime and assisting victims, hoping to atone for his past.
  “I feel like, you know, I owe a lot to the people … I kind of always feel ashamed about it.” (95:19 – Hieu)

Timestamps – Important Segments

• 00:10 – 02:01: Hieu’s origins as a young hacker in rural Vietnam
• 05:58 – 07:23: Discovery of Vietnam’s dark web forums
• 09:38 – 10:30: Rise on underground forums, becoming an administrator
• 12:50 – 16:09: First successful credit card thefts and laundering via poker sites
• 18:16 – 19:41: Selling cards at rock-bottom prices
• 27:20 – 29:03: Turning point: shift to targeting data brokers
• 39:26 – 42:17: Hieu’s illicit “people search” engine goes online; first big profits
• 49:12 – 50:34: “I was making more than 120k per month… more than 3 million USD”
• 59:25 – 61:26: Experian/Secret Service investigation; Hugh’s backup plans
• 62:13 – 64:19: The sting in Guam and his arrest
• 67:02 – 71:05: Charges and prosecution details; questions about actual “victims”
• 74:10 – 76:08: Host’s frustration with CFAA prosecutions and the ethics of data brokering
• 82:44 – 83:04: No breach notification from data brokers; secrecy and lack of transparency
• 93:49 – 95:36: Post-prison life: working on cyber defense, redemption, and public apology

Notable Quotes & Memorable Moments

“The more I say, the more the people, they know about me on these underground hacking forums. And eventually they voted me as an administrator in one of these forums.”
— Hieu (09:38)

“When you click on the record information, it pops out red card information.”
— Hieu on lack of payment security in admin panels (20:17)

“Eventually, I went back on the underground hacking forums. I sell the information. Visa and MasterCard, I sell for like 50 cent for one information. And American Express and Discover, Discover Card, I sell for from $1 to $3.”
— Hieu (18:16)

“Data brokers are just companies trying to make money. They do a great job at hiding their presence … Let me give you an example. I’m going to list eight of them for you. And I bet you’ve never heard of any of these companies, yet there’s a high chance that all of them know exactly what you’re doing right now.”
— Jack (35:00–36:00, paraphrased)

“The first week of him launching this website, he made $5,000 from people doing searches on it. It was an instant hit.”
— Jack (42:17)

“Back then I didn’t use Bitcoin. We used Liberty Reserve.”
— Hieu (42:39)

“You have to verify everything, but the CEO … gave me a good deal … 14 cent for one information … We make a business contract. I forge the signature … and they didn’t verify anything.”
— Hieu, on obtaining Court Ventures API access (47:59)

“After serving seven years in prison, they let him out in 2020. … When he got home, he got a job with the Vietnamese government to help with their national cyber defense.”
— Jack (93:27–94:05)

“I feel like, you know, I owe a lot to the people, especially the people in the U.S. I kind of hurt and harmed so many people’s lives and I kind of always feel ashamed about it.”
— Hieu (95:19)

Episode Tone & Reflections

• Candid and Remorseful: Hieu is frank about his journey, acknowledging wrongdoing and expressing deep regret.
• Critical and Analytical: Jack expresses frustration with the “gray zone” of U.S. data broker laws, CFAA misuse, and the moral ambiguity of selling data.
• Contemplative: The story spurs broader reflection on privacy, victimhood, and fundamental rights.
• Technical, Yet Accessible: The episode explains the nuts and bolts of hacking, data brokering, API use, and laundering schemes in a way that’s digestible for non-technical listeners.

Conclusion

This episode is a gripping, nuanced look at how one person’s curiosity led him to the heart of the world’s data privacy crisis—and how the lines separating legal, illegal, and unethical are often muddier than we like to think. Hieu’s redemption arc, and the ethical debates sparked by his story, leave listeners questioning not just the actions of hackers, but of the massive, shadowy data broker industry that quietly trades in the identities of millions every day.

Recommended Reading (from Jack):
Means of Control by Byron Tao—an eye-opening exposé on the data broker industry.

Memorable Final Words:
"They say if you don’t pay for it then you’re the product. But what if you pay a data broker to look up your own data? What then?" – Jack Rhysider (97:03)

End of summary.