TJX, which owns TJ Maxx, was one the firms whose records were hacked
A former informant of the US secret service has been accused of being the ringleader in the country's biggest and most complex identity theft case.
The US Department of Justice claims that Albert "Segvec" Gonzalez and 10 others stole, and then sold more than 40 million bank card numbers.
They allegedly got the data by driving around, finding vulnerable internet networks, and accessing shop records.
Prosecutors said the alleged fraud was an "international conspiracy".
"During the course of the sophisticated conspiracy Mr Gonzalez and his co-conspirators....hacked into wireless computer networks of major retailers," said the US Department of Justice.
The method, known as "wardriving", involves tracking down vulnerable internet wireless signals and using systems to decipher credit and debit card information from a retailer's system.
The Department of Justice said that companies affected included TJX Companies, BJ's Wholesale Club, Boston Market and Barnes & Noble among others.
MasterCard spokesman Chris Monteiro told the BBC: "If a cardholder is concerned at all about the security of their account they should immediately contact their issuing financial institution."
While the Department of Justice has not put a price on the scale on the scam it says it is the largest and most complex identity fraud to date.
"While technology has made our lives much easier it has also created new vulnerabilities," said US secret service director Michael Sullivan.
"This case clearly shows how strokes on a keyboard with a criminal purpose can have costly results," he added
He urged consumers, firms and governments worldwide to develop further ways to protect sensitive personal and business information and detect those that "conspire to exploit technology for criminal gain".
Perry Tancredi, senior product manager for fraud detection at payment security company VeriSign said that: "Regardless of how strong the security measures, and how vigilant, the weak part of the chain is there is always a human who is responsible and who has overall control over the information."
Mr Gonzalez of Miami has been charged with computer fraud, wire fraud, access device fraud, aggravated identify theft and conspiracy.
Mr Gonzalez, who is in New York in pre-trial confinement, now faces a maximum penalty of life in prison.
Charges were also listed against Christopher Scott and Damon Patrick, both of Miami.
The other named individuals in the case were Maksym "Maksik" Yastremskiy of Kharkov, Ukraine, Aleksandr "Jonny Hell" Suvorov of Sillamae, Estonia.
Charges were also levelled against Hung-Ming Chiu and Zhi Zhi Wang, both from China, and someone known only by the nickname "Delpiero".
Sergey Pavolvich, of Belarus, and Dzmitry Burak and Sergey Storchak, both of Ukraine, were also charged.