Hacker gets 20 years for stealing credit-card data from retailers