Dmytro Fedorov, 44, Fedir Hladyr, 33, and Andrii Kolpakov, 30, are high-ranking members of an "international cybercrime group" called "FIN7" which had dozens of members around the world, the department said in a statement.
"Since at least 2015, FIN7 members engaged in a highly sophisticated malware campaign targeting more than 100 US companies, predominantly in the restaurant, gaming, and hospitality industries," it said.
"FIN7 hacked into thousands of computer systems and stole millions of customer credit and debit card numbers, which the group used or sold for profit," it said.
The Justice Department said members of the "prolific hacking group" also targeted computer networks in Britain, Australia, and France.
FBI special agent Jay Tabb told a press conference in Seattle, Washington, where the arrests were announced, that the hacking was not state-sponsored.
"No linkage at all to any state-sponsored activity," Tabb said. "This is just old-fashioned organized crime."
Fedorov, a "high-level hacker and manager," was arrested in Bielsko-Biala, Poland, in January and is being detained pending extradition to the United States, the Department of Justice said.
Hladyr, FIN7's systems administrator, was arrested in Dresden, Germany, in January, it said, and is being held in Seattle, Washington, pending a trial scheduled to open on October 22.
Kolpakov, described as a "supervisor of a group of hackers," was arrested in Lepe, Spain, in late June and is being detained there pending a US extradition request, the department said.
Chipotle, Arby's targeted
"Cyber criminals who believe that they can hide in faraway countries and operate from behind keyboards without getting caught are just plain wrong," said Annette Hayes, US Attorney for the Western District of Washington.
The charges against the three were contained in federal indictments unsealed on Wednesday.
They were charged with 26 counts of conspiracy, wire fraud, computer hacking, access device fraud, and aggravated identity theft.
The Justice Department said that FIN7 also known as the "Carbanak Group" and the "Navigator Group," breached computer networks of companies in 47 US states and Washington DC.
They allegedly stole "more than 15 million customer card records from over 6,500 individual point-of-sale terminals at more than 3,600 separate business locations."
Among the companies which have publicly disclosed hacks by FIN7 are Chipotle Mexican Grill, Chili's, Arby's, Red Robin and Jason's Deli, the Justice Department said.
Many of the businesses were targeted through phishing schemes involving email.
"FIN7 carefully crafted email messages that would appear legitimate to a business' employee, and accompanied emails with telephone calls intended to further legitimize the email," it said.
Once an attached file was opened, it would trigger malware to steal payment card data which was sold on online underground marketplaces.
Eyewitness? Submit your stories now via social or:
Email: eyewitness@pulse.ng
