In an interview on "The NewsHour with Jim Lehrer," Lockyer said: "We currently have sufficient evidence to indict people both within Hewlett-Packard as well as outside."
"Crimes have been committed. People's identities were taken falsely, and it's a crime. People accessed computer records that have personal information. That's a crime."
The quotes were reported by the Wall Street Journal and confirmed by a spokesman for the Attorney General's Office.
State prosecutors are investigating, among other potential crimes, the use of "pre-texting" in HP's board's investigation of its own members to find the source of a news leak. "Pre-texting" is the act of obtaining someone's telephone records under false pretenses.
Earlier Tuesday, HP announced a series of executive changes as a result of the scandal. Board Chairwoman Patricia Dunn, who initiated the HP probe, was to step aside in January, and Chief Executive and President Mark Hurd was chosen to succeed her.
In addition, the company announced the resignation of board member George "Jay" Keyworth, a former science adviser to President Ronald Reagan and the person identified as the source of the leaks that sparked the scandal.
HP's troubles started last week when it acknowledged in a voluntary filing with the Securities and Exchange Commission that an investigation on its behalf had included questionable tactics. Almost immediately afterward, Lockyer described the tactics used to spy on HP board members and journalists as stupid and illegal in California. HP is based in Palo Alto, Calif.
In explaining Dunn's decision to launch the probe, HP said she was trying to stop leaks that could have threatened the company's competitiveness. HP also maintained that the company's leadership was unaware of the identities and methods, including "pre-texting," of third-party investigators.
Despite the explanation, a half dozen state and federal law enforcement and regulatory officials lined up to demand answers and documents in trying to determine who was responsible for obtaining as many as 20 people's personal phone records under false pretenses.