The call to the New Haven office of the F.B.I. came last December, a few days before Christmas. After years of warnings from the government and computer-security experts, a crime that had been widely feared had finally happened. An audacious computer hacker had broken into the systems of CD Universe, an Internet retailer based in Wallingford, Connecticut, and stolen the credit-card numbers of some 300,000 of the company’s customers. In an E-mail and a fax to the company’s executives, the hacker, who identified himself only as a Russian called “Maxus,” offered to sell the numbers back to the company for more than $100,000. If not, Maxus declared, he would sell them off piecemeal on the Internet.

This was big news; when The New York Times learned the outlines of the scheme a few weeks later, the story ran above the fold on page one. F.B.I. agents arrived at CD Universe’s offices that first day and immediately set up communication with Maxus. Details of what transpired remain closely guarded, but the agents are believed to have masqueraded as CD Universe executives in their talks with the hacker. Maxus was insistent; pay me now, he demanded, or I will auction off the numbers.

On Christmas Day, with the company still resisting his demands, Maxus carried through on his threat. In a move of breathtaking audacity, he unveiled a Web page in which he offered the numbers to anyone who paid up. “Hello, my name is Maxus,” the page read. “I would like to present you a credit cards [sic] datapipe. [E-mail me and] you will get a real credit card from the biggest online shop database. No kidding.”...