A second suspected hacker in the TJX breach case has pleaded guilty.

Christopher Scott, 25 and of Miami, Florida, has admitted his role in hacking into weakly secured wireless networks at retail outlets, a key component in a much more ambitious attack that harvested an estimated 45.7 million card records at TJX alone last year. Scott admitted computer hacking, access device fraud and identity theft offences as part of a plea bargaining arrangement. He faces a sentence of up to 22 years in jail and a fine of anywhere up to $1m for his crimes, AP reports.

Alleged cybercrime kingpin - Albert Gonzalez - who faces a possible lifetime sentence if convicted, has entered not guilty pleas. The other eight suspects in the case hail from former Soviet republics (Ukraine, Estonia and Belarus) and China. None have entered pleas.

Prosecutors allege hacking and credit card number fencing and counterfeiting on a massive scale against the gang.

Investigators reckon the group stole payment card data after hacking into the systems of retailers, mostly using Wi-Fi security flaws as the gateway onto corporate networks, before concealing the data on encrypted servers in the US and Eastern Europe. This data was used to either make counterfeit cards (which were subsequently cashed out) or sold on to other crooks, prosecutors allege.

As well as TJX, other retailers including Barnes & Noble, BJ’s Wholesale Club, OfficeMax, DSW and Forever 21 have been named as victims in the case in an indictment filed last month (summary here). ®

Related stories

• Carder linked to TJX hack jailed for 30 years by Turkish court (8 January 2009)
• Teen hacker confesses three-year crime spree (19 November 2008)
• NY man charged with boosting TJX credit hijack (5 November 2008)
• Fraudsters get into the cloud (29 October 2008)
• Turbo-charged wireless hacks threaten networks (10 October 2008)
• IT contractor caught stealing Shell Oil employee info (7 October 2008)
• (Former) gambling site worker cops to ID theft (23 September 2008)
• TJX hacker breaks ranks with guilty plea (15 September 2008)
• 'Ringleader' of retail hacking ring was Fed informant (6 August 2008)
• Feds charge 11 in TJX ID fraud case (6 August 2008)
• TJX employee fired for exposing shoddy security practices (23 May 2008)
• TJX credit card heist suspect, 2 others, accused of new scam (13 May 2008)
• Information security breaches quadrupled in 2007 (2 January 2008)
• TJX agrees to pay banks $41m to cover Visa losses (3 December 2007)
• TJX breach was twice as big as admitted, banks say (24 October 2007)
• Ukrainian jet setter in world's largest cyber heist? (22 August 2007)
• TJX takes $118m hit over massive security breach (16 August 2007)