Trio indicted for largest data theft in US history

Millions of credit cards were compromised in a series of attacks

Three men, one US citizen and two Russians, have been indicted for the largest data theft in US history.

Albert Gonzalez, also known as 'segvec', 'soupnazi' and 'j4guar17', and two unnamed accomplices have been charged by the Department of Justice (DoJ) with conspiracy to illegally access computers and conspiracy to engage in wire fraud.

Gonzalez is already in custody for the hacking of eight major retailers in an attempt to steal the details of 40 million credit cards.

"This investigation marks the continued success of law enforcement in tracking down cutting-edge hacking schemes committed by hackers working together across the globe," said acting US attorney Ralph Marra.

The trio used an SQL injection attack from proxy servers in California, Illinois, Latvia, the Netherlands and Ukraine to attack retail sites, and took elaborate precautions to cover their tracks, such as testing their malware against 20 leading security vendors' software and designing the attack code so that it deleted data on its activities.

The men stole information from 7-Eleven, Miami supermarket chain Hannaford Brothers and Heartland Payment Systems among others. The DoJ said that the companies' co-operation had been key to catching the three.

"When companies make the decision to work with law enforcement and disclose a data breach at the earliest possible opportunity, it provides the best chance of apprehending a hacker, and demonstrates that those corporate victims will actively defend their systems," Marra said.

The three men each face 35 years in prison, plus a substantial fine. It is not known whether the two Russian team members have been arrested.