The suspects allegedly hacked into the wireless computer networks of nine major retailers including TJX Cos, the parent of British retail chain TK Maxx, and Barnes & Noble.
Three of the accused are US citizens while the others are from Estonia, Ukraine, Belarus and China.
Michael Sullivan, a justice department lawyer, said that most of the victims were in the US but officials have yet to identify all those whose credit card numbers were stolen.
Law enforcement authorities from at least four countries were investigating the identity theft racket for three years.
Michael Mukasey, US attorney general, said that the total amount of money stolen was "impossible to quantify at this point".