FIN7 hacker sentenced to 10 years in prison

A Ukrainian national was sentenced today to 10 years in prison for his role in a cybercrime syndicate known as FIN7, a group that has orchestrated major attacks against point-of-sale systems across Europe and the US.

Fedir Hladyr, 35, was arrested in January 2018 in Dresden, Germany, and has been extradited to the US in July of the same year, where he was charged for his role in the FIN7 gang—also known as Carbanak.

According to court documents, Hladyr operated online using nicknames of "das" or "AronaXus" and was one of the leaders of the FIN7 gang, where he served as "systems administrator who, among other things, maintained servers and communication channels used by the organization and held a managerial role by delegating tasks and by providing instruction to other members of the scheme."

Between 2013 and 2018, Hladyr and his fellow FIN7 members orchestrated attacks against European and US retailers, breaching internal networks to install malware specialized in extracting payment card data from point-of-sale (PoS) systems, card data which they'd later sell on dark web markets.

According to the FBI, companies like Chipotle Mexican Grill, Chili's, Arby's, Red Robin, and Jason's Deli were some of FIN7's most high-profile victims, from where they're believed to have stolen more than 15 million card details from across more than 3,600 retail stores.

Hladyr was arrested and charged in 2018 together with two other FIN7 members, Dmytro Fedorov and Andrii Kopakov, also Ukrainian nationals. Both are still awaiting their sentencing.

A fourth FIN7 member, named Denys Iarmak, also a Ukrainian, was arrested in May 2020.

Hladyr was sentenced today via a Zoom meeting to 120 months and 60 months on separate charges, with the sentences to run concurrently.

In court today, Hladyr said he regretted working at Combi Security, the fake/front security firm that FIN7 hackers created to disguise some of their attacks as penetration tests.