Three members of an international cybercrime group known as “FIN7” have been arrested for hacking a number of U.S. companies, according to charges filed in the U.S. District Court in Seattle.
FIN7 members were engaged in “highly sophisticated malware campaign targeting” in over 100 U.S. companies, largely in the restaurant, gaming, and hospitality industries, according to the Department of Justice (DOJ). In total, they managed to steal over 15 million customer card records from over 6,500 individual point-of-sale terminals at more than 3,600 separate business locations.
Some of the affected restaurant chains in the United States were Chipotle Mexican Grill, Chili’s, Arby’s, Red Robin and Jason’s Deli. Breaches also took place in other countries including in the United Kingdom, Australia, and France.
“Cybercriminals who believe that they can hide in faraway countries and operate from behind keyboards without getting caught are just plain wrong,” said U.S. Attorney Hayes in a statement.
The group’s members “targeted American companies and citizens by stealing valuable consumer data, including personal credit card information, that they then sold on the Darknet,” Assistant Attorney General Benczkowski said.
Foreign authorities at the request of U.S. officials arrested Ukrainian Fedir Hladyr and a second FIN7 member, Dmytro Fedorov, separately, in January.
Hladyr, who was arrested in Dresden, Germany, is currently being held in Seattle, pending trial. He allegedly was the group’s systems administrator who maintained servers and communication channels and held a managerial role. His trial is scheduled for Oct. 22.
The second member, Fedorov, was a high-level hacker and manager who allegedly supervised other hackers tasked with breaching the computer systems. He was arrested in Bielsko-Biala, Poland, and remains detained there, pending an extradition to the United States.
The third FIN7 member, Ukrainian Andrii Kolpakov, was arrested in June by foreign authorities in Lepe, Spain. He was also allegedly supervising a group of hackers. Currently, he remains in custody in Spain, pending extradition to the United States.
Special Agent in charge Jay S. Tabb Jr. said the naming of the FIN7 leaders signifies a major step towards “dismantling this sophisticated criminal enterprise.”
“In many cases, FIN7 would accompany the phishing emails with a telephone call to the victim company employee about the same topic, which was intended to legitimize the phishing email,” the fact sheet said.
