The three-year investigation by federal agencies and overseas allies, which culminated in 11 people being charged on Tuesday, also brought home the global nature of the Internet's underground economy.

The scam targeted US companies, including clothes retailer TJ Maxx and bookseller Barnes & Noble, hacking into their databases to steal customers' details.

But the ring operated mainly in Eastern Europe, the Philippines, China and Thailand, and while three of those charged are US citizens, others are from places such as Estonia, Ukraine, Belarus and China.

The full scope of the damage may never be learned, but the United States Justice Department said the fraud reached at least into the tens of millions of dollars, and many potential victims have yet to be contacted.

'So far as we know, this is the single largest and most complex identity theft case ever charged in this country,' US Attorney-General Michael Mukasey said at a news conference in Boston, where he announced indictments.

TJX Companies, which owns TJ Maxx and Marshalls, another of the affected stores, discovered the security breach in its system in late 2006 and announced it early last year.

Another of the targets, shoe retailer DSW, discovered the breach in 2005.

But some other companies were not even aware that hackers had broken into their databases until Tuesday.

Barnes & Noble 'had not received inquiries from credit card companies or customers about these alleged activities', the company said.

The break in the case came when a handful of people were arrested in Florida last year, not long after TJ Maxx revealed that it had been hacked. They were caught trying to use fake credit cards to buy goods at Wal-Mart.

Some began cooperating, and the trail led to members-only websites as well as to Internet chats and Web transactions in the millions of dollars.

Two Chinese nationals - who are among several accused conspirators who remain abroad and at large - were charged with providing the blank cards that were encoded with stolen information.

The bigger suspects include Ukrainian Maksym Yastremskiy, accused of selling credit card numbers for more than US$10 million (S$14 million), and Aleksandr Suvorov of Estonia, who allegedly supplied Yastremskiy with the numbers and related data.

The two were arrested while on holiday in Turkey and Germany, respectively.

But to the chagrin of the US Secret Service, the ringleader of the scam appears to be one of its own informants, Miami resident Albert Gonzalez.

He is accused of double-crossing the agency by tipping off his cohorts to the ongoing investigation, and prosecutors say he could now face life in prison.

LOS ANGELES TIMES, ASSOCIATED PRESS