Barry described the investigation as ongoing, and said it is too early to know whether there would be more arrests.

The arrests appear to bolster recent analyst reports suggesting that online security breaches are not the leading cause of credit card and online fraud as many assume. The results of ayearlong study of about 5,000 U.S. consumers by Pleasanton, Calif.-based analyst firm Javelin Strategy & Research showed that despite recent hype, online data breaches are to blame for just 6 percent of all known cases of identity theft. That compared to 30 percent blamed on incidents such as losing one's wallet.

Javelin's conclusions were similar to those by other firms that have looked at the relationship between online data breaches and actual cases of ID fraud. In a 2005 study, Gartner Inc., for instance, found that just 18 percent of ID theft victims cited computer breaches, while 41 percent cited off-line causes. Another study released last year by ID Analytics showed that less than 1 percent of over 500,000 consumer records exposed in four separate data breaches were actually used in ID fraud.