Damon Patrick Toey has become the first person to be brought to justice after the hacking of TJX, which was one of the biggest cases of its kind.
More than 40 million credit card details were stolen in the attack, which went on for 18 months. Toey is the first to plead guilty and will be sentenced shortly. Charges have been filed against another 10 people.
"We are pleased that charges have been brought against the individuals allegedly responsible for the TJX computer intrusion(s), as well as breaches at many other major retailers," said the company.
"Since first learning of the intrusion(s), we have worked very closely with law enforcement authorities as they conducted an extensive international investigation of this complex crime.
"We thank both the US Secret Service and the Department of Justice for making the investigation and prosecution of cyber-crime a top priority."
Toey agreed to plead guilty to charges of wire fraud, credit card fraud and aggravated identity theft and help prosecutors in identifying other members of the gang, which had members in the US, Estonia, Ukraine, Belarus and China.
The alleged leader of the group, Albert Gonzalez, a former Secret Service informant, pleaded not guilty to similar charges during his initial appearance in Boston on Thursday.
Cotton seedling freezes to death as Chang'e-4 shuts down for the Moon's 14-day lunar night
Fortnite easily out-earns PUBG, Assassin's Creed Odyssey and Red Dead Redemption 2 in 2018
Meteor showers as a service will be visible for about 100 kilometres in all directions
Saturn's rings only formed in the past 100 million years, suggests analysis of Cassini space probe data
New findings contradict conventional belief that Saturn's rings were formed along with the planet about 4.5 billion years ago