Albert Gonzalez, the mastermind behind the hacking of TJX, which reaped more than 90 million credit and debit card numbers from TJX and other retailers, has been sentenced to two 20-year stretches in a federal prison.
The sentence is the longest ever for computer fraud in the US and, even with remission for good behaviour, Gonzalez, now 28, will be pushing 40 when he is released, since the two sentences will run concurrently.
Gonzalez also faces a $25,000 (£16,900) fine and may have to pay up to $192m (£129m) in restitution.
Gonzalez has already handed over $1.65m (£1.1m) in US currency, a house in Miami, a 2006 BMW, laptop computers and related equipment, a Glock 27 handgun, a Tiffany diamond ring and three Rolex watches. He had $1m (£672,000) in cash buried in his parent's back yard when arrested.
"I've read the letters from your family who love and support you, who talked about how loving you were as a young man, so there is another side to your personality," US district court judge Patti Saris told Gonzalez.
"Yet when I read the transcripts, there is this macho glee about how you beat the system."
The court heard how Gonzalez organised a gang of international hackers to carry out the attacks and turn the proceeds into cash, much of the time while he was a paid US Secret Service informant.
Prosecutors had asked for 25-year sentences, while his defence argued for 15 years, saying that Gonzalez suffered from Asperger's Syndrome and had learned his lesson from his time on remand.
The sentence comes a week after a former programmer for Barclays bank received a four-year sentence for his part in the attack.
Could be used for everything from search-and-rescue robots to wearable tech
Don't require the rare material being mined from the mountains of South America
IBM hopes that its new tool will avoid bias in artificial intelligence
Found by calculating the strength of the material deep inside the crust of neutron stars