The son of a Russian lawmaker was convicted Thursday on 38 counts related to his hacking of point-of-sale computers to steal and sell credit card numbers on the dark net.

Thirty two-year-old Roman Valerevich Seleznev, the son of Valery Seleznev, a member of the Russian Parliament, stood accused of 10 counts of wire fraud, eight counts of intentional damage to a protected computer, nine counts of obtaining information from a protected computer, nine counts of possession of 15 or more unauthorized access devices and two counts of aggravated identity theft following a 10-year-long investigation by the United States Secret Service.

Seleznev, who went by the name of “Track2” online, was alleged to have hacked into retail point-of-sale systems and installed malicious software (malware) to steal credit card numbers from various businesses from a server he operated in Russia between October 2009 and October 2013, resulting in more than $169 million in fraud losses from the theft and sale of more than 2.9 million credit-card numbers.

While targeting businesses across the country, Seleznev primarily targeted business in Washington State, including one by the name of the Broadway Grill in Seattle, which was forced into bankruptcy following the theft. Notably, it was revealed during the trial that Broadway Grill undertook appallingly bad security practices, including storing the credit card details of its customers in an unsecured text file.

Having obtained the credit card numbers, Seleznev then sold them on “carding” forums on the dark web, with cards with a 95 percent guarantee of working going for $20 t0 $30, while cards with a 65 percent of working selling for $7. It was alleged that he sold 140,000 credit card numbers this way, and made $2 million in the process.

Seleznev’s ultimate undoing was his desire to use his ill-gotten funds for travel, as he was arrested in the Maldives in 2014 on the behest of American authorities, where he was found with a laptop that contained more than 1.7 million stolen credit card numbers.

Appeal

A lawyer representing Seleznev said that they would appeal the verdict on the grounds that his arrest was illegal and that evidence presented at the trial was also invalid, as Seleznev’s laptop was also illegally seized.

Seleznev was arrested at Malé international airport but was never detained by local authorities nor appeared before a local court, causing the Russian Government to describe the arrest as a kidnapping.

A sentencing hearing is scheduled for December 2, with Seleznev facing a mandatory minimum of four years behind bars.

Image credit: Roman Seleznev/ Department of Justice