Three Ukrainians have been arrested for hacking more than 100 US companies and stealing millions of customer records, the Department of Justice announced Wednesday.
Dmytro Fedorov, 44, Fedir Hladyr, 33, and Andrii Kopakov, 30, were members of a “sophisticated international cybercrime group” called “FIN7,” the department said in a statement.
“Since at least 2015, FIN7 members engaged in a highly sophisticated malware campaign targeting more than 100 US companies, predominantly in the restaurant, gaming, and hospitality industries,” it said.
“FIN7 hacked into thousands of computer systems and stole millions of customer credit and debit card numbers, which the group used or sold for profit,” it said.
The Justice Department said members of the “prolific hacking group” also targeted computer networks in Britain, Australia, and France.
FBI special agent Jay Tabb told a press conference in Seattle, Washington, where the arrests were announced, that the hacking was not state-sponsored.
“No linkage at all to any state-sponsored activity,” Tabb said. “This is just old-fashioned organized crime.”
Fedorov, a “high-level hacker and manager,” was arrested in Bielsko-Biala, Poland, in January and is being detained pending extradition to the United States, the Department of Justice said.
Hladyr, FIN7’s systems administrator, was arrested in Dresden, Germany, in January, it said, and is being held in Seattle, Washington, pending a trial scheduled to open on October 22.
Kolpakov, described as a “supervisor of a group of hackers,” was arrested in Lepe, Spain, in late June and is being detained there pending a US extradition request, the department said.
– Chipotle, Arby’s targeted –
“Cyber criminals who believe that they can hide in faraway countries and operate from behind keyboards without getting caught are just plain wrong,” said Annette Hayes, US Attorney for the Western District of Washington.
The charges against the three were contained in federal indictments unsealed on Wednesday.
They were charged with 26 counts of conspiracy, wire fraud, computer hacking, access device fraud, and aggravated identity theft.
The Justice Department said that FIN7 also known as the “Carbanak Group” and the “Navigator Group,” breached computer networks of companies in 47 US states and Washington DC.
They allegedly stole “more than 15 million customer card records from over 6,500 individual point-of-sale terminals at more than 3,600 separate business locations.”
Among the companies which have publicly disclosed hacks by FIN7 are Chipotle Mexican Grill, Chili’s, Arby’s, Red Robin and Jason’s Deli, the Justice Department said.
Many of the businesses were targeted through phishing schemes involving email.
“FIN7 carefully crafted email messages that would appear legitimate to a business’ employee, and accompanied emails with telephone calls intended to further legitimize the email,” it said.
Once an attached file was opened, it would trigger malware to steal payment card data which was sold on online underground marketplaces.

More from AFP
- Spies, Hackers, Informants: How China Snoops on the US
- European Police Arrest 42 After Cracking Covert App
- Dutch, European Hospitals ‘Hit by Pro-Russian Hackers’
- Cyberattacks Target Websites of German Airports, Admin
- Meta Slapped With 5.5 Million Euro Fine for EU Data Breach
- International Arrests Over ‘Criminal’ Crypto Exchange
- France Regulator Raps Apple Over App Store Ads
- More Political Storms for TikTok After US Government Ban
Latest News
- Minister: Cybercrimes Now 20% of Spain’s Registered Offenses
- Skybox Security Raises $50M, Hires New CEO
- Spies, Hackers, Informants: How China Snoops on the US
- Australian Man Sentenced for Scam Related to Optus Hack
- Chrome 110 Patches 15 Vulnerabilities
- Application Security Protection for the Masses
- Tor Network Under DDoS Pressure for 7 Months
- Siemens License Manager Vulnerabilities Allow ICS Hacking
