This article was originally published by Radio Free Europe/Radio Liberty and is reprinted with permission.
A Ukrainian hacker has been sentenced to seven years in prison for his role in a notorious cybercrime group that stole credit- and debit-card information from millions of people in the United States and other countries.
The U.S. Department of Justice announced the sentencing of Andriy Kolpakov, 33, on June 24. Kolpakov, who pleaded guilty to wire-fraud and computer-hacking charges, was also ordered to pay $2.5 million in restitution, the department said in a press release.
Kolpakov’s lawyer said his client was disappointed with the sentence but respected the judge’s decision.
Kolpakov was arrested in Spain in 2018 and extradited to the United States.
The three years he has spent in custody count toward his sentence. He plans to return to Ukraine after serving out the rest, Vadim Glozman, his lawyer, told Reuters.
Kolpakov’s gang, known as FIN7, used carefully crafted e-mails that appeared to be legitimate and follow-up phone calls to target people working at hotels, casinos, and restaurants. Once the victims opened attachments, FIN7 would use malware to access financial information that the gang would then sell or use in other illicit ways.
Although the group also targeted victims in the United Kingdom, Australia, and France, it especially hit U.S. businesses.
U.S. prosecutors said the gang’s sophisticated operation had more than 70 people organized into departments and teams, including a unit devoted to crafting malicious software and another devoted to hacking into victims’ computers.
Prosecutors say Kolpakov worked for FIN7 from at least April 2016 until his arrest in June 2018 and rose to become a mid-level manager who directed a small team of hackers.
Two other Ukrainians charged in the FIN7 cybercrime are Fedir Hladyr, 35, who pleaded guilty in September 2019 after being extradited from Germany, and Dmytro Fedorov, who is being held in Poland.
Hladyr was sentenced to 10 years in prison in April after pleading guilty to hacking and wire-fraud charges. He confessed to serving as a manager and systems administrator for FIN7 and agreed to pay $2.5 million in restitution.
The 10-year sentence includes the three years Hladyr has already spent in custody.
