It is believed to be the largest identity theft case ever prosecuted -- the theft and sale of more than 41 million credit and debit card numbers.
Eleven suspects -- including one former U.S. Secret Service informant -- have been indicted in what's being called the biggest cyber-crime in history.
"This is the single, largest, and most complex identity theft case ever charged in this country," said U.S. Attorney General Michael Mukasey.
And they did it without any advanced computer know-how by using a technique known as "war-driving."
"War driving is simply driving around with a car, with a laptop computer, looking for accessible wireless networks," said U.S. Attorney Michael Sullivan.
Once they found one -- they installed special software that captured credit and debit card information.
From there, the ID thieves sold that data to other criminals in the U.S. and Europe -- something easily done over the Internet -- and they also used the credit card numbers to make duplicate cards for themselves. Then they'd hit up an ATM.
"It's remarkable, in fact that such a large, well-established corporations could be so vulnerable basically to a small group of criminals," said Marc Rotenberg with the Electronic Privacy Information Center.
They ripped off several major retailers, including Barnes & Noble, OfficeMax, and BJ's Wholesale Club.
Authorities couldn't say how much was stolen.
But TJ Maxx says they lost more than $200 million to this scam.
"I was very stunned that they didn't use, you know, the proper security from point to point," said Chris O'Ferrell, vice president of TJ Maxx's Security Division.
Computer experts say many companies now have restricted access to their wireless networks with security codes, but they say nothing is foolproof.
"There is no such thing as 100 percent security but that doesn't mean we should throw up our hands and say 'what's the use?' We can get a long way by applying appropriate technologies," said Philip Zimmerman, creator of Pretty Good Privacy.
As for those 40-million-plus customers who had their identities stolen -- the government started notifying them today.
Soource: The Associated Press, ABC News