Medcalf has been indicted on three felony counts of aggravated identity theft and one count of credit card fraud in connection with the incidents, according to the U.S. Attorney's office.

The Red Cross sent written notifications of the data breach to all 8,000 potential victims on May 17, advising them to contact credit bureaus to check their credit reports for any irregular purchases or activities. The agency is reimbursing any of the affected 8,000 donors if the credit reports can't be obtained for free. The agency also set up a toll-free hotline to aid any identity-theft victims of the incident and said it's taking additional security steps to ensure that such an incident doesn't happen again. All staff members are being reminded, for instance, that donors don't have to put their Social Security numbers into their Red Cross donor records.

The Red Cross also apologized for the incident and said it is working to improve security for such information.

If convicted, Medcalf faces a maximum penalty of 10 years in prison and/or a fine of $250,000 for the charge of credit card fraud. Each count of aggravated identity theft also carries a mandatory two years in prison consecutive to the credit card fraud sentence.

"We feel like victims here as well, but the ultimate victims are our donors," said Williams.