Three people arrested for massive Chipotle, Arby's, Chili's hacks

By: Emily Yussum

Posted: Aug 3, 2018 4:04 AM EST

By Jordan Valinsky

(CNN Money) -- Three alleged members of an international hacking group have been arrested for cybercrimes targeting over 100 retailers, including chains like Chili's, Chipotle and Arby's, the US government announced Wednesday.

The three men -- Dmytro Fedorov, 44, Fedir Hladyr, 33, and Andrii Kopakov, 30 -- are Ukranian nationals and, the Justice Department alleges, high-ranking members of a European hacker group known as FIN7. The group is accused of stealing more than 15 million customer card records in the US alone and selling them on the dark web.

The government said the group "stole millions of customer credit and debit card numbers, which the group used or sold for profit."

Fin7 used a company called Combi Security "to provide a guise of legitimacy and to recruit hackers to join the criminal enterprise," the DOJ said in a release.

Combi's website stated it provided services such as penetration testing, allowing companies to test weak spots in their security systems. Combi is believed to be headquartered in Israel and Russia and operating throughout Eastern Europe, Jay Tabb, the head of the FBI's Seattle field office, said during a press call on Wednesday.

"There are individuals involved in this syndicate that live and work in Eastern Europe," Tabb said. [The] investigation is ongoing. We only have three in custody."

Related: Saks, Lord & Taylor breach: Data stolen on 5 million cards

The members of FIN7 allegedly ensnared companies predominately in the restaurant, gaming and hospitality industries with a "highly sophisticated malware campaign," the press release said.

Tabb warned the group sent "carefully crafted emails" and placed phone calls to the employees of effected companies, encouraging them to open attachments with malware sent in the emails.

The government said the group breached the computer networks of companies in 47 states and the District of Columbia, as well as in the UK, Australia and France.

"The charges are very serious and my client may be facing decades in jail if convicted," said Hladyr's defense attorney, Arkady Bukh. "The case is very complex. ... There is no clear decision at this time if we will go to trial or will consider a plea." The other two people charged have not yet been assigned lawyers, according to the DOJ.

Hladyr was arrested in Germany and is currently detained in Seattle where he is awaiting trial, which is slated for October 22. The other two were arrested in Poland and Spain and are awaiting extradition to the US, according to the government.

Each of the three Ukranians is charged with 26 felony counts alleging conspiracy, wire fraud, computer hacking, access device fraud, and aggravated identity theft, the DOJ said.

--- Sara O'Brien and David Shortell contributed to this report

The-CNN-Wire