On 25 July 2013, the US Department of Justice made public a federal indictment issued by the US District Court of New Jersey charging five individuals with conspiracy in computer hacking, wire fraud and unauthorised computer access. The defendants are Vladimir Drinkman, Russian citizen, Alexandr Kalinin, Russian citizen, Roman Kotov, Russian citizen, Mikhail Rytikov, Ukranian citizen, and Dmitriy Smilianets, Russian citizen. The defendants together with four conspirators allegedly hacked major corporate computer networks and stole more than 160 million credit card numbers in order to sell them. The targeted companies are NASDAQ, 7-Eleven, Carrefour, JCP, Hannaford, Heartland, Wet Seal, Commidea, Dexia, JetBlue, Dow Jones, Euronet, Visa Jordan, Global Payment, Diners Singapore and Ingenicard. According to the US Department of Justice this is the largest data breach scheme ever prosecuted in the US.

According to the charging documents, the scheme was articulated in the following phases:

1. Scouting: the defendants and the conspirators identified potential corporate victims by searching their websites and studying their payment processing systems in order to identify vulnerabilities.

2. Illegal access: the defendants and the conspirators of illegally accessed the computer networks of the corporate victims by means of a Structured Query Language (SQL) injection attack, i.e. an attack on databases using the SQL language programming.

3. The malware: after gaining access, the defendants and the conspirators placed a malware in the hacked computer systems allowing them to access such systems at a later date in order to steal credit card information.

4. Concealing the attacks: it was part of the conspiracy that the defendants and the conspirators would use a number of advanced techniques to conceal their attacks. One of the techniques was bullet-proof hosting, i.e. leasing servers that are inaccessible to law enforcement. Another technique was the use of malware able to prevent anti-virus software from detecting the attacks.

5. Sale: after stealing credit card numbers and associated personal information (dumps), the defendants and the conspirators sold them in batches. The end users encoded the dumps onto magnetic strips of a blank plastic cards and used them to withdraw cash illegally from ATMs or make unauthorized purchases.

According to the US Department of Justice, as a consequence of the scheme, financial institutions, credit card companies and consumers suffered hundreds of millions in losses.
The charges described above are mere allegations that need to be proven in order to consider the defendants guilty.