from www.bloomberg.com – Albert Gonzalez, the computer hacker charged with stealing 130 million credit and debit card numbers, will plead guilty to previous data-theft charges in New York and Massachusetts and forfeit assets, U.S. prosecutors said.

Gonzalez faces 15 years to 25 years in prison, authorities said in a Massachusetts court filing yesterday. The sentences imposed in Massachusetts will run concurrently with any handed out in New Jersey, where Gonzalez was charged this month with stealing the credit card numbers, and New York, they said.

Federal prosecutors in Boston charged Gonzalez and others with stealing credit and debit card numbers from companies including TJX Cos., BJ’s Wholesale Club Inc., OfficeMax Inc., Barnes & Noble Inc. and Sports Authority Inc. The hackers scouted potential victims on a list of Fortune 500 companies and then visited retail stores to identify the payment processing systems and their vulnerabilities, prosecutors said.

Gonzalez agreed to forfeit more than $1.65 million in U.S. currency, a condominium in Miami, a blue 2006 BMW automobile, IBM and Toshiba laptop computers and related equipment, a Glock 27 firearm, a Nokia cell phone, a Tiffany diamond ring and three Rolex watches, according to the filing.

Gonzalez, who is in federal custody in Brooklyn, New York, was indicted last year by federal grand juries in Massachusetts and New York for data breaches at companies. He was a federal informant after his arrest in New Jersey by the U.S. Secret Service in 2003 in a case involving hackers known as the Shadowcrew, the U.S. Attorney’s Office in Boston said in a statement after indicting him on Aug. 5, 2008.

The Secret Service later discovered that Gonzalez, who was working as an informant for it, was criminally involved in the case, federal officials said last year.

In the Shadowcrew case, the Secret Service arrested 21 people in the U.S. in October 2004 for their role in one of the largest online centers for trafficking in stolen credit and bank card numbers. Gonzalez wasn’t indicted in that case.

Gonzalez and the two hackers were charged in Newark earlier this month with two counts of conspiracy in a scheme to sell data they stole using computers in New Jersey, California, Illinois, Latvia, Ukraine and the Netherlands, according to the indictment. He faces as many as 35 years in prison in the new case.

“As evidenced from the plea agreement, Albert has accepted responsibility for his actions and looks forward to a resolution of these cases,” said George Farkas, a lawyer who is representing Gonzalez.

Gonzalez was scheduled to go to trial Sept. 14 in federal court in Central Islip, N.Y., before U.S. District Judge Sandra Feuerstein. Among the charges is operating a fraud scheme from April through September in 2007, including hacking into computers at the corporate headquarters of Dave & Buster’s Inc., a restaurant chain, and stealing debit and credit card numbers.

In the new case, the hackers used software known as malware and so-called injection strings to attack the computers and steal data, prosecutors said. They installed “sniffer” programs to capture data “on a real-time basis” as it moved through the computer networks and used instant messaging services to advise each other on how to navigate the systems, according to the indictment. They also programmed malware to evade detection by anti-virus software and erase files that might detect its presence, prosecutors said.

The Massachusetts case is U.S. v. Albert Gonzalez, 08-CR-10223, U.S. District Court, District of Massachusetts (Boston). The New York case is U.S. v. Yastremskiy, 08-CR-00160, U.S. District Court, Eastern District of New York (Central Islip).