One of the TJX hackers has pleaded guilty to all charges in a 19-count indictment accusing him of masterminding one of the largest identity thefts in history.
Miami resident Albert Gonzalez, known by the screen name "segvec," was the third suspect to admit a role in stealing 40 million credit and debit card numbers from several US retailers.
The 28-year-old hacker faces 25 years in prison and will surrender over $2.7 million cash and other ill-gotten gains - among them a BMW and a condominium in Miami. Additional charges are still pending in New Jersey.
Gonzalez and 10 other individuals were arrested in Miami in 2008 on charges relating to thefts at TJX, Dave & Busters, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, Forever 21 and DSW. Another hacker in the gang was sentenced to 30 years in prison in Turkey.
The cyber gang reached from the US to the Ukraine and Southeast Asia, where the stolen credit and debit card numbers were used to withdraw cash from ATMs and to make purchases. It is not clear whether Gonzalez was at the centre of a worldwide criminal network or acting on behalf of more powerful gangs based in Russia and Eastern Europe.
Gonzalez's actions have cost victims millions of dollars in losses. TJX has estimated the data breach has cost the company nearly $200 million.
Gonzalez will remain in a federal facility in Rhode Island until sentencing on 8 December.
Click here for more on the prison sentences hackers face.
