Prosecutors said Gonzales, who is also known online as "soupnazi," targeted customers of convenience store giant 7-Eleven Inc. and supermarket chain Hannaford Brothers Co. Inc. They also targeted Heartland Payment Systems, a New Jersey-based [image-nocss] card payment processor.
Gonzales, who is already in jail awaiting trial in a hacking case, was indicted in New Jersey, charged with conspiring with two other unnamed suspects to steal the private information. He is awaiting trial in New York for allegedly helping hack the computer network of the national restaurant chain Dave & Buster's. Trial in that case is due to begin next month.
He faces up to 20 years in prison if convicted of the new charges.
The Justice Department said the new case represents the largest alleged credit and debit card data breach ever charged in the United States, beginning in October 2006.
Gonzales allegedly devised a sophisticated attack to penetrate the computer networks, steal the card data and send that data to computer servers in California, Illinois, Latvia, the Netherlands and Ukraine.
The indictment also charges that Gonzales and his co-conspirators used sophisticated hacker techniques to cover their tracks and avoid detection.
Also last year, the Justice Department announced additional charges against Gonzales and others for hacking retail companies' computers for the theft of approximately 40 million credit cards. At the time, that was believed to be the biggest single case of hacking private computer networks to steal credit card data.
Members help make our journalism possible. Become a CSP member today and unlock exclusive benefits, including unlimited access to all of our content. Sign up here.