By David Harry
Staff Writer

Last week’s guilty pleas by the man accused of helping steal credit and debit cards from Hannaford Bros. customers does not mean the company has emerged from the legal woods.
Albert Gonzalez, 28, pleaded guilty to two counts of conspiring to hack into computer networks of retail chains including Hannaford Bros. Co. of Scarborough and 7-Eleven and credit card processor Hartland Payment Systems, according to a press release from the U.S. District Attorney’s Office in Boston.
He entered his pleas in U.S. District Court in Boston before Judge Douglas P. Woodlock. Gonzalez will face a sentence of 17 to 25 years in federal prison. His sentencing hearing is scheduled for March 18 in Boston.
Hannaford Bros. spokesman Michael Norton praised law enforcement officials for their work in prosecuting Gonzalez. However Norton said he could not comment on the extent of the breach against the company because of a pending suit against the supermarket chain.  Hannaford Bros. has about 165 stores in New England and New York.
The negligence suit filed against the company was shifted to U.S. District Court in Portland last fall after several parties filed suit against Hannaford Bros. and Sweetbay, two companies owned by Belgian-based Delhaize Group.
On Nov. 24, Judge D. Brock Hornby turned the suit over to the Maine Supreme Judicial Court. Hornby has asked justices for their opinion on two questions about how Maine law applies to negligence claims against Hannaford Bros. because plaintiffs sustained no physical harm and were not ultimately liable for fraudulent charges made to their accounts.
Plaintiffs in the case are seeking unspecified damages for the time and effort needed to clear up fraudulent charges. In his order to supreme court justices, Hornby said 4.2 million credit and debit card numbers, PIN numbers, security codes and other information was stolen from the Hannaford computer network from November 2007 through February 2008.
 Norton declined to verify the information Hornby listed in his court order to the Maine Supreme Judicial Court. He said data was stolen “in transit” as it went through the company network that was maintained at standards compliant with those recommended in the payment card industry.
A clerk at the Maine Supreme Judicial Court said briefs related to the case are due by February and then a hearing will be scheduled.
Since discovery of the thefts, Norton said Hannaford Bros. “has invested a substantial amount” in creating more secure networks for its customers. The company retained several firms, including General Dynamics, to better encrypt and protect customer information.
According to the U.S. District Attorney’s Office in Boston, the guilty pleas by Gonzalez came after he also pleaded guilty last September to 19 counts of conspiracy, computer fraud, wire fraud, access device fraud and aggravated identity theft for his role in data thefts from other retailers. They  included TJX Companies, BJ’s Wholesale Club, OfficeMax, Boston Market, Barnes & Noble and Sports Authority. Gonzalez also pleaded guilty to one count of conspiracy to commit wire fraud relating to hacks into the Dave & Buster’s restaurant chain.
Officials said Gonzalez will be sentenced for those offenses March 19 in Boston.

Staff writer David Harry can be reached at 282-4337, ext. 219