Three alleged hackers from Ukraine have been arrested on hacking and identity theft charges in a wide-ranging and yearslong malware campaign that took aim at U.S. companies, according to federal prosecutors in Seattle.
The hackers allegedly took part in hacks that targeted more than 100 American companies, like Chipotle, Chili's and Arby's, and stole 15 millions of credit and debit card numbers, which were sold on the dark web. Justice Department officials said Wednesday the hackers were administrators or supervisors in a prominent, international hacking ring called FIN7.
"The naming of these FIN7 leaders marks a major step towards dismantling this sophisticated criminal enterprise," said Jay Tabb Jr., special agent in charge of the FBI's Seattle field office, in a statement.
Officials said that Fedir Hladyr, 33, was arrested in Germany in January and Dmytro Fedorov, 44, was arrested in Poland around the same time. Andrii Kolpakov, 30, was arrested in Spain in June. Hladyr has been brought to the U.S. while the others are still awaiting extradition.
Since at least 2015, the FIN7 hacking ring hacked into computer networks in all but three U.S. states along with more networks abroad, prosecutors said. Some companies have disclosed that they were hacked by FIN7, like Chipotle, Chili's and Arby's; prosecutors said the hackers used email messages and follow-up phone calls that appeared legitimate.
FIN7 also recruited hackers through a front company called Combi Security that listed some victims as purported clients, according to prosecutors.