A Miami man has pleaded guilty to criminal charges of hacking into computer networks of major U.S. retailers and stealing data related to more than 40 million credit and debit cards, the U.S. Justice Department said Friday.

In a statement, the Justice Department said Albert Gonzalez, 28 years old, pleaded guilty to 20 counts of conspiracy, computer fraud, wire fraud, access device fraud and aggravated identity theft in U.S. District Court in Boston.

A lawyer for Gonzalez didn't immediately return a phone call seeking comment Friday.

Nineteen of the charges related to alleged hacking of U.S. retailers: TJX Cos. (TJX), BJ's Wholesale Club Inc. (BJ), OfficeMax Inc. (OMX), Boston Market, Barnes & Noble Inc. (BKS) and Sports Authority Inc. (TSA). Those charges were brought by the U.S. Attorney's office in Boston in August 2008.

One conspiracy count related to alleged hacking of the Dave & Busters restaurant chain and were brought by the U.S. Attorney's office in Brooklyn in May 2008.

"Consumers must be able to trust that the credit and debit cards they use everyday in thousands of stores around the world are safe from unlawful access," said Assistant Attorney General Lanny A. Breuer of the Justice Department's Criminal Division in a statement.

Prosecutors have alleged that Gonzalez and others broke into retail credit-card payment systems through a series of sophisticated techniques, including a technique known as "wardriving" and installation of sniffer programs to capture credit- and debit-card numbers used at these retail stores.

Gonzalez and others allegedly sold the numbers to others for their fraudulent use and engaged in ATM fraud by encoding the data on the magnetic stripes of blank cards and withdrawing tens of thousands of dollars at a time from ATMs.

Under the Boston plea agreement, Gonzalez faces a minimum of 15 years and a maximum of 25 years in prison. He also faces up 20 years in prison under the Brooklyn agreement. Under the agreements, the parties have agreed the sentences should run concurrently.

He also has agreed to pay restitution and forfeiture of more than $2.7 million. The forfeited currency includes more than $1 million in cash, which Gonzalez had buried in a container in his backyard, prosecutors said.

Sentencing is scheduled for Dec. 8.

Gonzalez is still facing federal charges by the U.S. Attorney's office in Newark, N.J., for allegedly hacking into U.S. retail and financial companies and stealing data related to more than 130 million credit and debit cards.

-By Chad Bray, Dow Jones Newswires; 212-227-2017; chad.bray@dowjones.com