Hacker Albert Gonzalez, accused of masterminding the massive data thefts at BJ's Wholesale Club, TJX and several other retailers, pleaded guilty to some of the largest identity-theft crimes on record on Friday while leaving the federal judge wondering how to compensate his millions of victims.

He pleaded guilty Friday to 19 counts of conspiracy, computer fraud, wire fraud, access device fraud and aggravated identity theft in U.S. District Court for the District of Massachusetts, according to court paper filings.

Gonzalez, 28, of Miami, was a member of a group of hackers that stole over 40 million credit and debit card numbers from stores like; TJX, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble and Sports Authority, the DOJ said.

This is the largest and most costly identity theft in U.S. history, Assistant U.S. Attorney Stephen Heymann told U.S. District Judge Patti Saris, according to

U.S. authorities found the 40 million records on computers in Ukraine and Latvia involved in the ring, Heymann said.

He faces similar charges in New Jersey. In August, Gonzalez was also indicted in New Jersey for the theft of more than 130 million credit and debit cards.

Based on the terms of the Boston plea agreement, Gonzalez faces a minimum of 15 years and a maximum of 25 years in prison. Based on the New York plea agreement, Gonzalez faces up to 20 years in prison, which the parties have agreed should run concurrently with the Boston sentence.

Gonzalez also faces fines of $250,000 in both cases, but the fines could be increased to twice his gains and twice the victims' losses in the Boston case.

Sentencing is scheduled for Dec. 8.

Ukraine New Jersey Hacking Criminal Law