Eleven people are in jail in what the U.S. Department of Justice is calling the largest hacking and identity theft case in its history.

The suspects in the retail hacking ring are accused of stealing and selling more than 40 million credit and debit card numbers from major American retail stores.

Investigators say the charges include conspiracy, computer intrusion, fraud and identity theft.

Three of those arrested are U.S. citizens. Albert “Segvec” Gonzalez, of Miami, is charged with computer fraud, wire fraud, access device fraud, aggravated identity theft and conspiracy for his role in the scheme. Christopher Scott and Damon Patrick Toey, both of Miami, face related charges. Of the other suspects, three are from the Ukraine, two from China, and one each from Estonia and Belarus. One individual is only known by an alias online, and his place of origin is unknown.

The DOJ says the numbers were stolen in an elaborate scheme using a technique called “wardriving” and hacking into the wireless computer networks of major retailers — including TJX Companies, BJ’s Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, Forever 21 and DSW. After getting inside those networks, “sniffer” programs were installed that grabbed the card numbers, along with password and account information on the retailers’ credit and debit processing networks.

The indictment alleges that after they collected the data, the conspirators concealed it in encrypted computer servers controlled in Eastern Europe and the United States. They allegedly sold some of the credit and debit card numbers, via the Internet, to other criminals in the United States and Eastern Europe. The stolen numbers were “cashed out” by encoding card numbers on the magnetic strips of blank cards. The defendants then used these cards to withdraw tens of thousands of dollars at a time from ATMs. Gonzalez and others were allegedly able to conceal and launder their fraud proceeds by using anonymous Internet-based currencies both within the United States and abroad, and by channeling funds through bank accounts in Eastern Europe.
“So far as we know, this is the single largest and most complex identity theft case ever charged in this country,” said Attorney General Michael Mukasey. “It highlights the efforts of the Justice Department to fight this pernicious crime and shows that, with the cooperation of our law enforcement partners around the world, we can identify, charge and apprehend even the most sophisticated international computer hackers.”