A Canadian man accused of participating in a Yahoo hacking scheme in 2014 pleaded guilty in a San Francisco courtroom on Tuesday.
Karim Baratov, 22, pleaded guilty to one count of conspiracy to commit computer fraud and abuse and eight counts of aggravated identity theft.
The 2014 hacking campaign affected around 500 million people in one of the largest breaches in history. It is separate from a 2013 breach that compromised every Yahoo account — some 3 billion.
In March, the Justice Department indicted two Russian spies and two cybercriminals for the 2014 hack: Russian intelligence officers Dmitry Dokuchaev and Igor Sushchin, and hired hackers Alexsey Belan and Baratov.
The complaint said hackers accessed millions of Yahoo email accounts through targeted attacks and broader spam campaigns. They searched emails to try and steal credit card information, financial documents, and login information to other sites, according to court documents.
When the Russian spies found targets with email accounts in addition to Yahoo addresses, they paid Baratov to access those accounts, prosecutors said.
“This case is a prime example of the hybrid cyber threat we’re facing, in which nation states work with criminal hackers to carry out malicious activities,” Executive Assistant Director Paul Abbate of the FBI’s Criminal, Cyber, Response and Services Branch said in a statement on Tuesday.
Baratov could face up to 26 years in prison, Judge Vince Chhabria said in the courtroom Tuesday.
His lawyers said after the hearing that prosecutors are recommending a prison sentence of 70 to 87 months for the computer fraud and abuse count plus two years for all of the counts of aggravated identity theft.
Baratov is a Canadian citizen born in Kazakhstan. Canadian authorities arrested him in March and he was extradited to the U.S. Baratov initially pleaded not guilty, but changed his plea on Tuesday.
On Instagram, Baratov previously shared photos of a seemingly lavish lifestyle, including posing with expensive cars in front of his house.
The sentencing hearing is scheduled for February 20.
