US prosecutors said on Tuesday they had charged 11 people in connection with a hacking ring that allegedly stole and sold more than 40m credit and debit card numbers from nine US retailers in what could be the country’s biggest identity theft case.

The scheme involved residents of at least five countries who breached security systems and installed programs that gathered personal financial data which they sold to others or used themselves, prosecutors claimed in indictments unsealed in Boston and San Diego on Tuesday.