The identity theft is the biggest ever reported.
The thieves used the stolen identities to withdraw "tens of thousands of dollars at a time from ATMs", said the US Department of Justice.
The men allegedly parked outside TJX and other stores and used laptop PCs to hack into their unprotected wireless networks to steal the details of credit and debit card account holders.
Those charged include three US citizens, three Ukranians, two Chinese an Estonian, and a Belo-Russian. One who has still to be identified, is still known only by his "handle" or online name.
TJX, which owns UK retailer TK Maxx, announced the theft of the accounts a year ago. It has since paid millions in compensation and damages to account holders whose details were stolen and sold on, and to banks that were defrauded as a result.