Eleven people face charges over the hacking of nine major US retailers and the theft and sale of more than 41 million credit and debit card numbers.