"So far as we know, this is the single largest and most complex identity theft case ever charged in this country," Attorney General Michael B. Mukasey said in a prepared statement.
Three of the defendants are from the U.S., one is from Estonia, three are from Ukraine, two are from China, and one is from Belarus.
The indictment, returned in Boston, alleges that Albert "Segvec" Gonzales of Miami and others schemed to steal credit and debit card numbers by wardriving and hacking into the wireless networks of stores owned by TJX, BJ's Wholesale Club Inc., OfficeMax Inc., Boston Market Inc., Barnes & Noble Inc., The Sports Authority Inc., Forever 21 Inc., and DSW Inc. The ring allegedly installed sniffers on the retailers' networks to capture card numbers, passwords and account information.
In March of 2007, TJX disclosed that hackers had stolen at least 45.7 million customer credit and debit card data.
Gonzales was charged with computer fraud, wire fraud, access device fraud, aggravated identity theft and conspiracy. He faces life in prison if convicted of all the charges.
Indictments unsealed in San Diego charged Maksym Yastremskiy and Aleksandr Suvorov in connection with the sale of the credit card data stolen by Gonzales and others, as well as additional stolen credit card information. In May, Gonzales, Yastremskiy and Suvorov were charged in a related indictment for hacking into computer systems at 11 restaurants owned by Dave & Buster's Holdings Inc., and stealing credit and debit card numbers.
On Tuesday, Yastremskiy and Suvorov were indicted with six others on charges of operating an international ring dealing in stolen credit and debit cards. According to prosecutors, Yastremskiy made more than $11 million from his criminal activity.