One of the 11 people arrested last month in connection with the massive data theft at TJX Companies, BJ Wholesale Clubs and several other retailers pleaded guilty Thursday to four felony counts including wire and credit card fraud and aggravated identity theft.
Damon Patrick Toey is scheduled to be sentenced on 10 December in US District Court in Boston. He faces a maximum prison term of 5 years and a fine of US$250,000 on each of the counts. In addition, under the terms of the plea agreement, Toey has to forfeit all of the money he earned for his role in the data theft.
Toey was one of 11 alleged hackers arrested last month in connection with a series of data thefts and attempted data thefts at TJX and numerous other companies. Besides TJX and BJs, the list of publicly identified victims of the hackers includes DSW, OfficeMax, Boston Market, Barnes and Noble, Sports Authority and Forever 21.
In a court filing yesterday, Assistant US Attorney Stephen Heymann said that there is "forensic and/or testimonial evidence" that Toey and his co-conspirators broke into "numerous" other business that have not been publicly identified. Heymann said he would be willing to submit the full list "in camera" to the court if needed.
The ID theft ring stole data involving more than 45 million payment cards, leaving 100 or so financial institutions vulnerable to losses from fraud, Sullivan said.
The breach was made public in January 2007 by TJX, which later reported in a filing with the US Securities and Exchange Commission that 45.6 million credit card numbers were affected - the largest such breach on record.