US charges three Ukrainians in payment card hacking spree
Three Ukrainians have been arrested on criminal hacking charges including stealing payment card numbers, in attacks on more than 100 US companies that cost businesses tens of millions of dollars, the US Justice Department said on Wednesday.
US prosecutors alleged that the three Ukrainians, who were arrested in Europe between January and June, are members of FIN7, a notorious cybercrime gang.
Victims include the Chipotle Mexican Grill
FIN7 has previously been linked to breaches of Trump Hotels, Whole Foods
One of the three defendants, Fedir Hladyr, 33, has been transferred to Seattle from Dresden, Germany, where he was arrested. Authorities said they are seeking the extradition of the other two: Dmytro Fedorov, 44, and Andrii Kolpakov, 30.
Hladyr has pleaded not guilty and denies wrongdoing, according to his attorney, Arkady Bukh.
"There is no clear decision at this time whether (we) will go to trial or will consider a plea," Bukh said via email.
Reuters could not reach lawyers for the other two.
The three stole and sold payment card numbers and other data belonging to US citizens and businesses, Assistant Attorney General Brian Benczkowski said in a statement.
FIN7 sent "phishing" emails to companies, sometimes following up with phone calls urging employees to open tainted attachments, the indictments said.
Ukrainian officials could not be reached for comment.
FIN7, also widely known as Carbanak, employs dozens of individuals who handle highly specialized tasks such as breaking into networks, stealing payment card numbers and selling stolen data on underground criminal forums, said Adrian Nish, head of threat intelligence with BAE Systems.
The defendants used a front company named "Combi Security" that claims to have offices in Moscow, Haifa and Odessa, to launch some intrusions, according to court documents.
Combi Security's website describes it as an expert "in the field of comprehensive protection of large information systems from modern cyber threats."
Cybersecurity firm FireEye said it found job advertisements for Combi Security posted to several different Russian, Ukrainian and Uzbek job recruitment websites.
FIN7 stole more than 15 million customer card records from US businesses and also targeted companies in Australia, France and the United Kingdom, according to US prosecutors.