Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Andrii Kolpakov, a Ukrainian national described by U.S. prosecutors as a high-level member of the FIN7 cybercrime group, was sentenced on June 24, 2021, to seven years in prison. The U.S. District Court for the Western District of Washington also ordered him to pay $2.5 million in restitution. The sentence applied to Kolpakov—not to FIN7 as a whole.
Who was the FIN7 member sentenced in the U.S.?
The defendant was Andrii Kolpakov. The U.S. Department of Justice (DOJ) described him as a high-level hacker whom FIN7 members called a “pen tester.” According to the DOJ’s account, he worked with the group from at least April 2016 until his arrest in June 2018 and managed other hackers assigned to breach victims’ computer systems.
Kolpakov was arrested in Lepe, Spain, on June 28, 2018, at the request of U.S. law enforcement. He was extradited to the United States on June 1, 2019. In June 2020, he pleaded guilty to one count of conspiracy to commit wire fraud and one count of conspiracy to commit computer hacking. These case details come from the DOJ’s June 24, 2021 sentencing announcement.
Recommended Free Tools
What sentence did Kolpakov receive?
On June 24, 2021, the court sentenced Kolpakov to seven years in prison and ordered him to pay $2.5 million in restitution, according to the DOJ. Chief U.S. District Judge Ricardo S. Martinez said at sentencing: “To indiscriminately prey on millions of people… the consequences must be serious.”
#1 Best Overall
What did prosecutors say FIN7 did?
The DOJ described FIN7’s method as a targeted social-engineering campaign. Members sent employees carefully written emails designed to appear legitimate, then followed up with phone calls. If a recipient opened and activated an attached file, the group could use an adapted version of Carbanak malware and other tools to access computer systems and steal payment-card data.
The DOJ said some stolen card numbers were offered for sale in underground marketplaces. It also said Kolpakov received compensation for his work and that FIN7 members continued attacks after learning of reported arrests of other members. These are details attributed to the DOJ’s account of the prosecution.
How large was the reported impact?
The following figures are those reported in the DOJ’s June 24, 2021 sentencing release. They are prosecution-era totals and estimates, not newly measured or independently audited figures.
- Card records and terminals: More than 20 million customer card records were reported stolen from over 6,500 point-of-sale terminals at more than 3,600 U.S. business locations.
- Geographic reach: The DOJ said business networks were breached in all 50 states and the District of Columbia.
- Estimated costs: The DOJ said victim costs were estimated in some accounts to exceed $1 billion. This is an estimate, not a precise audited loss total.
- Kolpakov’s restitution: The court ordered $2.5 million in restitution from Kolpakov.
The DOJ case index contains older summaries with different figures, including different card-record and state counts. Those figures come from material published at different times and should not be blended with the June 2021 sentencing release as if they were one uniform count. The DOJ’s FIN7 case index lists related proceedings and case materials.
Rank #3
Was the sentence for all FIN7 members?
No. The seven-year sentence and restitution order were imposed on Kolpakov alone. The DOJ case index lists other defendants and separate proceedings; their cases and outcomes should not be treated as part of his sentence.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
