A US man, the ringleader of a group that used financial information stolen from TJX customers for fraudulent purchases, was sentenced this week to five years in prison and ordered to pay $600,000 (£300,000) in restitution.

Irving Escobar, 19, of Miami, pleaded guilty to charges that he used fake credit cards layered with information stolen in the notorious data breach to buy approximately $3 million (£1.5 million) in goods and gift cards.

Escobar was one of six people arrested in March for participating in the credit card fraud ring. The group was accused of travelling around Florida purchasing large amounts of gift cards with the stolen information.

The arrests were the result of a joint investigation conducted by the Gainesville Police Department and the Florida Department of Law Enforcement.

Co-defendants Dianelly Hernandez, Julio Alberti, Reinier Alvarez, and Zenia Llorente pleaded guilty in August and were sentenced to probation, according to the authorities. Nair Alvarez, Escobar's mother, also pleaded guilty and was deported to Venezuela.

Mary Monahan, a partner with Javelin Strategy and Research, said that she hopes Escobar's sentencing will be followed by the arrests of the individuals responsible for the breach itself.

"It's a good sentence. He's the ringleader for the group and everyone else got probation," she said. "The thing is that he's actually a small fish. He's 19 years old, and somebody supplied him with those credit card numbers, and hopefully they can get that person."

A TJX spokesperson could not immediately be reached for comment.

The TJX breach was the result of a scheme that began in 2005 when intruders used a "telephone-shaped antenna" and laptop to decode data moving among store scanning devices, cash registers and PCs that were using wireless LAN connectivity, according to reports. The hackers may have ciphered data for up to two years.