Federal authorities said on Tuesday that they had cracked the largest case of identity theft in US history, charging 11 people in the theft of more than 40 million credit and debit card account numbers from computer systems at such major retailers as TJ Maxx and Barnes & Noble.

The three-year investigation brought home the global nature of the Internet’s underground economy as agents tracked leads from China to Ukraine and picked up suspects in Turkey and Germany as well as the US.

The Justice Department said the fraud reached at least into the tens of millions of dollars. Many potential victims are yet to be contacted.

The break in the case began when a handful of people were arrested in Florida last year, not long after TJ Maxx revealed that it had been hacked. They were caught trying to buy goods at Wal-Mart by using fake credit cards that had been encoded with the account numbers and other data lifted from TJ Maxx.

The revelation capped years of data-loss horror stories emanating from companies, Government institutions and elsewhere.