Two Romanian nationals pleaded guilty Monday to charges stemming from a scheme to hack into and steal payment card data from hundreds of US merchants, officials said.

The Justice Department said Iulian Dolan, 28, of Craiova, Romania, pleaded guilty to one count of conspiracy to commit computer fraud and related charges. Cezar Butu, 27, of Ploiesti, Romania, pleaded guilty to one count of conspiracy.

Both will serve prison terms under their plea agreement, officials said.

The two admitted to participating in a Romanian-based scheme from 2009 to 2011 with co-conspirator Adrian-Tiberiu Oprea, who is in US custody and awaiting trial.

Prosecutors said the group hacked into merchant databases to steal credit, debit and payment account numbers and associated data then used the stolen payment card data to make unauthorized charges or sold the data.

Federal prosecutors noted that the scheme affected more than 146,000 compromised cards and led to more than $10 million in losses.

According to investigators, Dolan scanned the Internet to identify vulnerable systems with certain remote desktop software applications. He cracked passwords, then remotely installed software programs called "keystroke loggers" to record data that was keyed into or swiped through the merchants' systems.

Oprea later attempted to use the stolen payment card data to make unauthorized charges on, or transfers of funds from, the accounts, prosecutors said.

In his plea agreement, Butu admitted that he acquired stolen payment card data from Oprea belonging to some 140 cardholders.

Dolan has agreed to be sentenced to seven years, and Butu to 21 months in prison, under their plea agreements.