Three Fin7 Members Nabbed for $15M Card Heist

Three high-ranking members of the notorious international cybercrime group Fin7, also known as the Carbanak Group and the Navigator Group, have been arrested and are currently in custody facing charges filed in U.S. District Court in Seattle.

According to three federal indictments unsealed today, Ukrainian nationals Dmytro Fedorov, 44, Fedir Hladyr, 33, and Andrii Kolpakov, 30, are accused of engaging in a highly sophisticated malware campaign targeting more than 100 U.S. companies, predominantly in the restaurant, gaming, and hospitality industries.

Since at least 2015, FIN7 members allegedly hacked into thousands of computer systems and stole millions of customer credit and debit card numbers, which the group used or sold for profit. In the United States alone, FIN7 successfully breached the computer networks of companies in 47 states and the District of Columbia, stealing more than 15 million customer card records from over 6,500 individual point-of-sale terminals at more than 3,600 separate business locations.

Companies that have publicly disclosed hacks attributable to FIN7 include familiar chains such as Chipotle Mexican Grill, Chili’s, Arby’s, Red Robin, and Jason’s Deli. Additional intrusions occurred abroad, including in the United Kingdom, Australia, and France.

Assistant Attorney General Brian A. Benczkowski stated, “The three Ukrainian nationals indicted today allegedly were part of a prolific hacking group that targeted American companies and citizens by stealing valuable consumer data, including personal credit card information, that they then sold on the Darknet.”

U.S. Attorney Annette L. Hayes added, “Protecting consumers and companies who use the internet to conduct business – both large chains and small ‘mom and pop’ stores — is a top priority for all of us in the Department of Justice.”

Each of the three FIN7 conspirators is charged with 26 felony counts alleging conspiracy, wire fraud, computer hacking, access device fraud, and aggravated identity theft.