FIN7 Supervisor Gets 7-Year Jail Term for Stealing Millions of Credit Cards
A Ukrainian national and a mid-level supervisor of the hacking group known as FIN7 has been sentenced to seven years in prison for his role as a “pen tester” and perpetuating a criminal scheme that enabled the gang to compromise millions of customers debit and credit cards.
Andrii Kolpakov, 33, was arrested in Spain on June 28, 2018, and subsequently extradited to the U.S. the following year on June 1, 2019. In June 2020, Kolpakov pleaded guilty to one count of conspiracy to commit wire fraud and one count of conspiracy to commit computer hacking.
The Western District of Washington also ordered Kolpakov to pay $2.5 million in restitution.
FIN7, also called Anunak, Carbanak Group, and the Navigator Group, is said to have engaged in a sophisticated malware campaign at least since 2015 targeting restaurant, gambling, and hospitality industries in the U.S. to plunder credit and debit card numbers that were then used or sold for profit on underground forums.
According to court documents, FIN7 used a firm called Combi Security as a front to recruit hackers — one of them being Kolpakov — to “provide a veil of legitimacy to the illegal enterprise,” while projecting itself as “one of the leading international companies” that offered penetration testing services to customers worldwide.
The total damages stemming from these intrusions exceeded $1 billion, the DoJ said.
Kolpakov is the second member of the FIN7 group to be sentenced in the U.S. since the start of the year. In April, another 35-year-old Ukrainian national Fedir Hladyr was awarded 10 years in prison for his role as a high-level manager and systems administrator responsible for maintaining the server infrastructure that FIN7 used to attack and control victims’ machines.
