Ukrainian national Andrii Kolpakov has been sentenced to seven years in prison and ordered to pay a restitution of $2.5 million for his role in the FIN7 criminal group, the Justice Department reported this week.

Kolpakov, who officials say has used multiple different names, was a high-level pen-tester for FIN7. He was arrested in Spain in June 2018 at the request of US law enforcement and extradited to the US in June 2019. One year later, Kolpakov pleaded guilty to one count of conspiracy to commit wire fraud and one count of conspiracy to commit computer hacking.

Public documents indicate since at least 2015, FIN7 (also known as the Carbanak Group and the Navigator Group) launched a sophisticated malware campaign against hundreds of US companies that were mostly in the restaurant, gambling, and hospitality industries. Attackers broke into thousands of computer systems and stole millions of customer credit and debit card numbers, which were then used or sold for profit, officials wrote in a release.

Kolpakov was involved with FIN7 from at least April 2016 until he was arrested in 2018, and managed other members responsible for breaking into target systems.

This isn't the first member of FIN7 to be arrested for their role in the criminal group. High-level admin Fedir Hladyr was sentenced in April 2021 to 10 years in prison. In their June 24 release, DoJ officials noted FIN7 members, including Kolpakov, were aware other participants were arrested but continued to target US businesses.

Read the full DoJ release for more details.