Eleven people, one a US secret service informant, have been indicted by the US Department of Justice (DoJ), in what is thought to be the largest ever case of online credit and debit card fraud.

The defendants are three US citizens, three Ukrainians, two Chinese, an Estonian and a Belorussian, and one individual only known by an online alias.

The accused are alleged to have hacked into the computer networks of nine major US retailers, including TJ Maxx (known as TK Maxx in the UK) and stolen the details of more than 40 million credit and debit cards before using them to siphon off millions of dollars.

It is believed that they managed to hack the wireless computer networks by what is called 'wardriving' – driving around looking for vulnerabilities in wireless networks.

According to the DoJ, once inside the networks the gang installed 'sniffer' programs. These captured card numbers as well as password and account information. The ring then used encrypted computer servers that they controlled in Eastern Europe and the United States to store the information.

The stolen numbers were 'cashed out' by encoding card numbers on the magnetic strips of blank cards. The defendants then used these cards to withdraw tens of thousands of dollars at a time from cash machines.

It is alleged that some of the credit and debit card numbers were also sold on to other criminals in the US and Eastern Europe via the internet. The gang was able to conceal and launder the proceeds of the crimes by using anonymous internet-based currencies in the US and abroad.

An indictment has been brought against Albert 'Segvec' Gonzalez of Miami, the alleged ringleader of the gang. He will face charges of computer fraud, wire fraud, access device fraud, aggravated identity theft and conspiracy before a Boston grand jury.

The grand jury has also brought related charges against Christopher Scott and Damon Patrick Toey, also of Miami.

A San Diego grand jury has indicted alleged participants Maksym 'Maksik' Yastremskiy, of Kharkov, Ukraine, Aleksandr 'Jonny Hell' Suvorov, of Sillamae, Estonia, Hung-Ming Chiu and Zhi Zhi Wang, both of the People's Republic of China, and a person known only by the online nickname 'Delpiero'.

Because of the size and scope of his crimes, the DoJ said Gonzalez, who is in custody in New York, faces a maximum penalty of life in prison if he is convicted of all the charges.