Credit-card information was stolen from thousands of victims in New Jersey, Pennsylvania, and other states using "skimming" devices installed at gas pumps, prosecutors said.