The U.S. Department of Justice said Friday that one man had pleaded guilty and two others had been indicted for what prosecutors called the largest data breach in U.S. history.
Giang Hoang Vu, a Vietnamese citizen, entered a guilty plea Thursday.
Another Vietnamese suspect, Vie Quoc Nguyen, is still at large. A Canadian, David-Manuel Santos Da Silva, has been charged with helping the other two launder stolen money.
The breach is the subject of a congressional investigation. Prosecutors said the defendants allegedly made millions of dollars by stealing more than 1 billion email addresses and using them to send spam, or unwanted computer messages generally used to try to sell goods.
The three worked out of Canada, the Netherlands, and Vietnam from 2009 until 2012, when Dutch police arrested Vu.
Acting U.S. Attorney John Horn said the case "reflects the cutting-edge problems posed by today's cybercrime cases, where the hackers didn't target just a single company; they infiltrated most of the country's e-mail distribution firms."
Horn called the scope of the intrusion "unnerving."
But U.S. officials said the case demonstrated that those carrying out data theft and fraudulent schemes could not remain anonymous.
The Justice Department's announcement came on the same day British police said they had arrested a 23-year-old man for allegedly taking part in a cyberattack on the Pentagon's computer system last June. He was one of 56 people arrested in a nationwide crackdown in Britain on cybercrime.
The Pentagon said the hackers stole information on about 800 people, including email addresses and telephone numbers, but U.S. national security was never at risk as a result of the theft.