- Wednesday August 06 2008 10:57 BST
Eleven people were today charged in the US in connection with the theft of more than 41m credit and debit card numbers in the country's biggest case of identity theft.
It is believed to be the largest hacking and identity theft prosecution by the US Department of Justice. Charges include conspiracy, computer intrusion, fraud and identity theft, and involve the breaching of nine major US retailers' computer defences.
The indictment, returned by a federal grand jury in Boston, said the suspects had hacked into the wireless computer networks of retailers including TJX Cos, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, Forever 21 and DSW.
Three of those charged are US citizens; three are from Estonia, three from Ukraine, two from China and one from Belarus.
"While technology has made our lives much easier, it has also created new vulnerabilities," US attorney Michael Sullivan said. "This case clearly shows how strokes on a keyboard with a criminal purpose can have costly results."
Sullivan said the alleged thieves were not computer geniuses, just opportunists who had used a technique called "wardriving", which involves cruising through different areas with a laptop and looking for accessible wireless internet signals.
Once they had located a vulnerable network, he said, they installed "sniffer programmes" that captured credit and debit card numbers as they moved through a retailer's processing networks.
The information was stored on two servers, in Ukraine and Latvia. One of these contained more than 25m credit and debit card numbers, the other more than 16m, Sullivan said.
"They used sophisticated computer hacking techniques that would allow them to breach security systems and install programmes that gathered enormous quantities of personal financial data, which they then allegedly either sold to others or used themselves," said the attorney general, Michael Mukasey, in a press conference.
"In total, they caused widespread losses by banks, retailers, and consumers."
Mukasey said the total amount of the alleged theft was "impossible to quantify at this point". He said officials still had not identified all the victims who had had credit or debit card numbers stolen.
"I suspect that a lot of people are unaware that their identifying information has been compromised," he warned.