Gery Shalon, Joshua Samuel Aaron and Ziv Orenstein, all from Israel, were charged in a 23-count indictment with alleged crimes targeting 12 companies, including nine financial services companies and media outlets including The Wall Street Journal.
Prosecutors said the enterprise dated from 2007, and caused the exposure of personal information belonging to more than 100 million people.
"By any measure, the data breaches at these firms were breathtaking in scope and in size," and signal a "brave new world of hacking for profit," U.S. Attorney Preet Bharara said at a press conference in Manhattan.
The alleged enterprise included pumping up stock prices, online casinos, payment processing for criminals, an illegal bitcoin exchange, and the laundering of money through at least 75 shell companies and accounts around the world.
Tuesday`s charges expand a case first announced in July, and according to U.S. Attorney General Loretta Lynch target "one of the largest thefts of financial-related data in history."
The charges are also the first tied to the JPMorgan attack, which prosecutors said involved the stealing of records belonging to more than 83 million customers, the largest theft of customer data from a U.S. financial institution.
Authorities said Shalon and Aaron executed that hacking, using a computer server in Egypt that they had rented under an alias that Shalon often used.
A separate indictment unveiled in Atlanta against Shalon, Aaron and an unnamed defendant said the brokerages E*Trade Financial Corp and Scotttrade Inc were also targets, and personal information of more than 10 million customers was compromised.
TD Ameritrade Holding Corp and News Corp`s Dow Jones unit, which publishes The Wall Street Journal, said they were also targets. Fidelity Investments was also a target, a person familiar with the matter said.
Other targets could not be immediately verified.
Shalon, 31, of Savyon, Israel, and Orenstein, 40, of Bat Hefer, Israel, were arrested in July. Aaron, 31, a U.S. citizen who lives in Moscow and Tel Aviv, remains at large and is the subject of an FBI "wanted" poster.
Another defendant, Anthony Murgio, 31, of Tampa, Florida, was charged separately over the bitcoin exchange, Coin.mx. He was originally charged in July, and faces an arraignment on Friday. A co-defendant in that case, Yuri Lebedev, is in "discussions" with prosecutors, Bharara said.
Lawyers for the defendants were not immediately available for comment.
JPMorgan on Tuesday confirmed that the latest charges relate to the 2014 attack, and said it continues to cooperate with law enforcement efforts to fight cybercrime.
It also said that only contact information such as names, addresses and emails was accessed, and that account information, passwords or Social Security numbers were not compromised.
U.S. charges three in huge cyberfraud targeting JPMorgan, others
11 November 2015
Read: 842
U.S. prosecutors on Tuesday unveiled criminal charges against three men accused of running a sprawling computer hacking and fraud scheme that included a huge attack against JPMorgan Chase & Co and generated hundreds of millions of dollars of illegal profit.
