Largo man stole data from millions, U.S. says

The check service worker got $580,000, the charges say, and victims got more junk mail.

By SCOTT BARANCIK, Times Staff Writer
Published November 15, 2007

Certegy Check Services, a St. Petersburg company that advises retailers whether a customer's check is likely to bounce, maintains a detailed financial database on millions of U.S. consumers. It's the sort of information direct marketers crave.

According to a criminal complaint filed in Tampa federal court, senior database administrator William G. Sullivan obliged that craving to an extreme.

Over a five-year period, the 54-year-old Largo man methodically stole confidential records on more than 8.4-million U.S. consumers, including 460,000 Floridians, authorities charged. Most of the records included credit card, debit card and/or bank account numbers. For his clandestine efforts, Sullivan was paid a total of $580,000.

In court papers and public statements, the company said the stolen records apparently were used solely to create mailing lists for marketers. There was no indication that they were used for identity theft or other fraud.

Sullivan has agreed to plead guilty to felony fraud charges, pay court-ordered restitution and cooperate with an ongoing investigation. In exchange, the U.S. Attorney's Office will recommend a reduction from the maximum five-year prison sentence. A plea hearing will be held next week.

More indictments may follow. Prosecutors said a data broker who paid Sullivan for the records and resold them to direct-marketing companies was an "unindicted co-conspirator." Those buyers also might be in trouble if they knew the information was stolen.

Meanwhile, consumer lawsuits filed in several states raise questions about security procedures at Certegy, which employs hundreds in St. Petersburg.

Those employees are already in flux: Certegy's parent company, Fidelity National Information Services of Jacksonville, has identified the St. Petersburg check service operation as non-essential and may sell it.

Among the questions posed by the lawsuits: Why did it take Certegy more than five years to find out that confidential consumer information was being sucked out of its database? Is it doing enough to protect consumers from identity theft or account fraud? And why did the company wait several months to tell them about the theft?

Even the scope of the breach took months to become clear. Certegy initially indicated last summer that 2.3-million records had been stolen.

About 60 percent of the Florida records contained bank account numbers, 25 percent had credit card and/or debit card information, and 15 percent had only the consumer's name and address. None had Social Security numbers.

Attempts to reach Certegy's president and outside counsel Wednesday afternoon were unsuccessful.

Sullivan didn't draw attention to himself like some more flamboyant crooks. Arrested twice, for petty theft in 1991 and later for DUI, he has been married to Mary Sullivan for more than half his life.

The couple have lived in the same humble home, valued by the Pinellas property appraiser at $121,800, for nearly 25 years. They purchased three vehicles in the past two years, all of them used: a 1991 Mazda Miata convertible, 1997 Honda motorcycle and 2003 Jeep Grand Cherokee.

But the Sullivans have struggled financially. In 1992, they filed for Chapter 7 bankruptcy liquidation. Earlier, their local homeowner's association had filed a lien against them.

Sullivan transferred the deed on the couple's home to Mary on July 3, a day after Certegy filed a fraud suit against him. Mary Sullivan obtained the title to her Grand Cherokee two days later.

How much restitution Sullivan should pay, and to whom, will be debated. Brown, Sullivan's lawyer, said the 8.4-million consumers have suffered nothing more vexing than a little extra junk mail and need not be compensated. He added that Certegy doesn't deserve a blank check either, in part because it took so long to catch Sullivan. It's not clear who will get the $107,000 that federal officials seized from a Sullivan bank account.

"He lived a very unassuming lifestyle and like many people at the end of the day said, 'Where did all that money go?'" Brown said. "He has no assets or any 'African adventure' trips to speak of. In short, the money just got spent."

Times researchers Carolyn Edds and Caryn Baird contributed to this report. Scott Barancik can be reached at barancik@sptimes.com or 727 893-8751.