Loading story…
Dutch courts cleared the extradition of Russian national Vladimir Drinkman to the United States in a case prosecutors described as the largest hacking and data-breach conspiracy ever prosecuted there. U.S. authorities alleged Drinkman and four co-defendants used SQL injection, malware backdoors, and network sniffers to penetrate payment processors, retailers, and financial institutions, stealing more than 160 million credit and debit card numbers over several years and causing hundreds of millions of dollars in losses. Victims named in court filings included Heartland Payment Systems, 7-Eleven, Hannaford, Carrefour, JetBlue, Global Payments, Dow Jones, and NASDAQ, though prosecutors said the NASDAQ intrusion did not affect its trading platform.
The prosecution tied the operation to the broader payment-card theft ecosystem exposed in earlier cases involving Albert Gonzalez, who had already been accused of orchestrating some of the largest U.S. retail breaches. After his transfer to the United States, Drinkman later admitted his role in the conspiracy, marking a major step in a long-running investigation into an international crew that allegedly harvested card data from corporate networks and sold it through criminal resellers. The case underscored how a small group of Russian and Eastern European defendants allegedly sustained long-term access inside major companies and monetized stolen payment data at unprecedented scale.
See attribution, scope, and your downstream exposure.
9 events from the most recent confirmed update back to the earliest known activity.
Vladimir Drinkman admitted his role in the massive hacking and payment-card theft conspiracy prosecuted in New Jersey. His plea marked a significant prosecutorial milestone in the long-running case.
The U.S. Justice Department announced that Vladimir Drinkman had been extradited from the Netherlands to face charges in New Jersey. He was accused of participating in the largest known data-breach prosecution in the United States.
The Hague District Court approved the extradition of Russian national Vladimir Drinkman to the United States, rejecting defense objections and a competing Russian request. U.S. authorities sought him over his alleged role in the massive payment-card theft conspiracy.
A federal indictment unsealed in New Jersey charged five men in a global hacking scheme that allegedly stole more than 160 million credit and debit card numbers from payment processors, retailers, and financial institutions. Prosecutors said the operation caused hundreds of millions of dollars in losses and involved victims including Heartland, 7-Eleven, Carrefour, JCP, Hannaford, JetBlue, Global Payment, Dow Jones, and NASDAQ.
Dutch authorities arrested Vladimir Drinkman and Dmitriy Smilianets in 2012 in connection with the long-running payment-card hacking conspiracy. Their arrests were later cited in the U.S. indictment unsealed in New Jersey.
Albert Gonzalez's lawyer said he had been nearing a global plea agreement covering multiple major hacking cases before the New Jersey indictment intervened. The report described the indictment as disrupting negotiations that could have resolved several active prosecutions.
U.S. prosecutors brought a New Jersey indictment tied to breaches at Heartland Payment Systems, 7-Eleven, and Hannaford Bros., alleging theft of more than 130 million payment-card numbers. The case identified Albert Gonzalez as a central figure and charged additional foreign conspirators.
A Businessweek report examined the Heartland Payment Systems breach and its implications for payment security. This reflects public disclosure and industry response to one of the key victim intrusions in the later criminal case.
Heartland Payment Systems publicly disclosed a major intrusion affecting payment-card data. The breach later became one of the central incidents in the broader U.S. hacking conspiracy case.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
8 references tracked. Mallory keeps watching after this page renders.
theguardian.com
Open sourcejustice.gov
Open sourcejustice.gov
Open sourcejustice.gov
Open sourcechicagotribune.com
Open sourcebits.blogs.nytimes.com
Open sourcecomputerworld.com
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Albert Gonzalez, known online as **`SoupNazi`**, was sentenced to 20 years in prison for leading a hacking ring behind some of the largest payment card breaches prosecuted in the United States. U.S. authorities said Gonzalez and his co-conspirators infiltrated major retailers and payment processors including **TJX, BJ’s Wholesale Club, OfficeMax, Barnes & Noble, Sports Authority, Dave & Buster’s, 7-Eleven, Hannaford Brothers,** and **Heartland Payment Systems**, stealing tens of millions of credit and debit card numbers and causing losses estimated at nearly **$200 million**, with broader economic damage potentially reaching into the billions. Court records said the group used **wardriving** to find vulnerable wireless networks, deployed sniffers and Trojan malware to capture payment card data, and moved stolen information through anonymous online currencies and bank accounts in Eastern Europe. The Justice Department described the operation as the largest hacking and identity theft ring then prosecuted by the U.S. government, involving accomplices in the United States, Estonia, Ukraine, and Turkey, affecting more than **250 financial institutions**, and resulting in multiple guilty pleas, extraditions, and related convictions tied to the sale and fraudulent use of more than **40 million** stolen card numbers.
Jul 22, 2026
U.S. authorities reported multiple enforcement actions against financially motivated cybercrime. In South Carolina, two Venezuelan nationals convicted in an **ATM jackpotting** scheme will be deported after serving their sentences; prosecutors said they physically accessed older ATM models, connected a laptop, and installed malware that bypassed security controls to force cash-out until the machines were emptied. The activity impacted banks across several southeastern states, with court-ordered restitution of **$285,100** and **$126,340** respectively, and investigators said evidence from the case contributed to a broader Nebraska indictment of dozens of individuals tied to a larger ATM-theft conspiracy. Separately, a Russian national, **Ianis Aleksandrovich Antropenko**, pleaded guilty in federal court to **conspiracy to commit money laundering** and **conspiracy to commit computer fraud and abuse** for leading a ransomware operation that targeted at least 50 victims over a four-year period ending in August 2022; he faces up to **25 years** in prison, financial penalties, restitution, and forfeiture, and the plea acknowledges potential immigration consequences. A third item describes convicted Bitcoin thief **Ilya Lichtenstein** seeking post-release work in cybersecurity, but it is not tied to the ATM jackpotting or Antropenko ransomware case and does not add incident-specific threat intelligence.
Jun 29, 2026
Russian national and web developer Sergei Anatolyevich Filimonov, 36, was extradited from the Republic of Georgia to the United States on allegations that he helped operate a bank-account takeover and wire-fraud scheme. Prosecutors allege that from November 2023 through October 2025, Filimonov and co-conspirators purchased sponsored-search advertisements, impersonated bank domains, and deployed fraudulent banking login pages to steal customer credentials and facilitate unauthorized wire transfers. The alleged operation maintained infrastructure to retain stolen credentials and gather information used to bypass bank security controls. U.S. authorities linked a December 2025 seizure of `web3adspanels.org` and its stolen-password database to at least 19 U.S. victims, about $28 million in attempted losses, and roughly $14.6 million in confirmed losses; alleged transfers involving two banks in June and November 2024 totaled nearly $6.315 million. Filimonov pleaded not guilty in the Northern District of Georgia on September 4 and remains in custody.
Sep 9, 2026