Data Thefts May Be Linked

The searches were divided between the FBI and Secret Service, Bresson said. Jonathan Cherry, a Secret Service spokesman, declined to comment on the case.

Bresson said the FBI was investigating whether hackers involved in the LexisNexis case might also be connected to the theft of information from a cell phone account owned by Hilton. But he said the FBI "does not know if that is true at this point."

In February, several Web sites published photos, some of them showing Hilton topless; private notes; and phone numbers of her celebrity friends.

Nine people were served search warrants by investigators, according to the federal law enforcement official, who would not be identified because of his role in this and other ongoing investigations. The official did not specify which members of the group may have been involved in the theft of Hilton's cell phone data.

The law enforcement source also said an arrest Tuesday of four people in Northern California was connected to the LexisNexis investigation. Special Agent Larae Quy at the FBI's San Francisco field office said four people were detained by Hayward, Calif., authorities on drug-related charges, but she did not confirm a connection to the LexisNexis investigation, saying the warrants had been sealed by a court order and that she was barred from discussing them.

Officials at the Washington headquarters of the FBI and Secret Service declined to comment.

The link between the LexisNexis and Paris Hilton investigations is supported by online conversations that a washingtonpost.com reporter had with the minor whose home was searched. The minor said he was involved in both intrusions and provided an image of what he said was a Web page that only T-Mobile employees would have access to, which allowed group members to retrieve Hilton's cell phone data. T-Mobile declined to comment.

He also provided an image that appeared to be a search-results screen that only a LexisNexis account holder would be able to see.

Officials from both companies declined to comment on the authenticity of the screen shots or on whether they could only have been taken by a person who had gained access to a restricted part of their online networks.

According to an account provided by the member of the hacker group -- and confirmed by the law enforcement source familiar with the case -- the LexisNexis break-in was set in motion by a blast of junk e-mail. Sometime in February a small group of hackers, many of whom knew each other only through online communications, sent out hundreds of e-mails with a message urging recipients to open an attached file to view pornographic images of children. The attachments had nothing to do with child porn; rather, the files contained a program that allowed the group's members to record anything a recipient typed on his or her computer keyboard.

According to the hacker, a police officer in Florida was among those who opened the infected e-mail message. Not long after his computer was infected with the keystroke-capturing program, the officer logged on to his police department's account at Accurint, a LexisNexis service provided by Florida-based subsidiary Seisint Inc., which sells access to consumer data. Other officers' log-in information may have been similarly stolen, the law enforcement source said.

The young hacker said the group members then created a series of sub-accounts using the police department's name and billing information. Over several days, the hacker said the group looked up thousands of names in the database, including friends and celebrities. The law enforcement source said members of the group eventually began selling Social Security numbers and other sensitive consumer information to a ring of identity thieves in California. Washingtonpost.com has not been able to reach the young hacker to seek comment about the sale of personal information.

LexisNexis first disclosed the breach on March 9. At the time, Kurt P. Sanford, head of LexisNexis's corporate and federal markets groups, told The Washington Post that perpetrators used computer programs to generate IDs and passwords that matched those of legitimate customers. In other cases, he said, hackers appear to have collected IDs and passwords after using malicious programs to collect the information from infected machines as they were being used.

Krebs is a staff writer for washingtonpost.com. Washington Post staff writers Dan Eggen and Jonathan Krim contributed to this report.