A Ukrainian man accused by US authorities of involvement in the TJX data breach has been jailed for 30 years in Turkey after being found guilty of hacking the computer systems of 12 banks in the country.
Maksym Yastremskiy was arrested whilst on holiday in Turkey in July 2007, and accused of breaking into Turkish bank accounts electronically.
US authorities quickly linked him to the theft and sale of over 40 million credit and debit card numbers that were hacked from the computer systems of nine major US retailers, including TJX.
American investigators claimed that information from Turkish police holding Yastremskiy, along with details from credit card issuers, indicated he was a major trafficker in stolen information, including data stolen in the TJX hacking.
Yastremskiy allegedly sold card numbers through online forums hosted outside the US and was responsible for millions of dollars of losses.
Although US authorities filed extradition papers against Yastremskiy he has now been convicted in Turkey on the separate charges. According to local reports, he pleaded not guilty but was convicted yesterday in a court in the city of Antalya.
Turkish law prevents his extradition to the US until after he serves his sentence, one of the heaviest ever seen for a cybercrime.
In August 2008 Yastremskiy was one of 11 people, including gang leader Albert "Segvec" Gonzalez, indicted by US authorities over the TJX breach.
The group are accused of hacking into the wireless computer networks of retailers and installing "sniffer" programs that would capture card numbers, as well as password and account information, as they moved through the retailers' credit and debit processing networks.
Yastremskiy is not believed to have been involved in the actual hack but is alleged to have acted as a fence, selling card numbers to other criminals over the Internet.
Suspect in TJX theft gets prison - The Boston Globe