Hacker pleads guilty in breach

Federal prosecutors won a guilty plea yesterday from one of 11 men who made up a ring that was charged last month with the largest data theft case in history, involving tens of millions of customers of retailers, including TJX Cos. of Framingham and BJ's Wholesale Club of Natick.

Separately the government also said it has evidence the group breached the security of many more businesses than previously disclosed.

At a hearing in federal District Court in Boston yesterday afternoon, Damon Patrick Toey, 23, of Miami, pleaded guilty to multiple charges, including wire fraud, credit card fraud, and aggravated identity theft. Prosecutors alleged he helped the accused ringleader, Albert Gonzalez, to break through the computer security of a number of retail stores in the Miami area.

Gonzalez himself appeared at a second hearing later in the day and pleaded not guilty to a set of similar charges.

Prosecutors said both men were key players in a loose-knit ring spanning countries from China to Ukraine that stole or trafficked in more than 40 million payment cards in all, causing more than $400 million in damages. The ring initially accessed customer data by using laptops to penetrate wireless networks of retail stores, from which they were able to access the companies' servers.

At the hearing for Toey yesterday, Assistant US Attorney Stephen Heymann elaborated on his role in the scheme. Toey first helped Gonzalez steal money from automated teller machines in the New York area in 2004, then became more involved in stealing and selling card data from vulnerable retail computer networks, according to Heymann and previous government filings. Last year he lived rent-free at Gonzalez' Miami condo, the government said.

When asked by Judge William G. Young why he was entering the plea, Toey said prosecutors "have enough, other than what I'm pleading guilty to," on him, "that would make it a lot worse, in my opinion."

It was the longest utterance of the day for Toey, who said he had an eighth-grade education. He entered his plea even though his defense attorney, Syrie Fried, and prosecutors hadn't agreed on just how much in losses his actions caused, which could affect his eventual sentence. Technically he could face more than 30 years in prison, judge Young said at one point.

Young released Toey on probation, at least temporarily, to a location in the Norfolk, Va., area, where Fried said he grew up and has family. Toey will be subject to electronic monitoring, face travel restrictions, and be barred from using computers.

And in a separate court filing yesterday, Heymann wrote the government has evidence that Toey and his coconspirators hacked into "numerous other businesses." The filing did not disclose the businesses, and Heymann did not release any more details in court. In all, more than 40 million credit and debit card numbers were stolen by the conspirators, Heymann wrote, potentially victimizing hundreds of banks that issued the cards.

Ross Kerber can be reached at kerber@globe.com.