According to the indictment, SQL injection strings, a series of instructions to computers used by hackers in furtherance of SQL injection attacks, were placed on victims' networks and programmed to identify, store and export information on computers that were hacked, including information such as credit and debit card numbers and corresponding personal identification information of cardholders..