LOS ANGELES – A Russian national was sentenced today to 70 months in federal prison for hacking into the accounts of two companies and issuing unauthorized debit cards associated with dependent care accounts to conspirators around the world, leading to losses of more than $4 million.

Mikhail Konstantinov Malykhin, 36, an illegal alien who was living in the Park La Brea district of Los Angeles, was sentenced by United States District Judge Dolly M. Gee after admitting to hacking into the accounts and conspiring to use the fraudulent debit cards.

In addition to the 70-month sentence, Judge Gee ordered Malykhin to pay $4,131,731 in restitution. Malykhin has agreed to forfeit approximately $1.3 million in cash and more than $22,000 in gift cards previously seized by FBI agents from Malykhin's safe deposit boxes, as well as several gold bars, nearly $30,000 that Malykhin sent to a plastic surgery center, and a 1966 Ford Mustang.

Judge Gee today described Malykhin's offenses as “reprehensible,” noting that he had “caused much pain” and “ruined the lives of many of his victims.”

Malykhin pleaded guilty in 2016 to two felony offenses – conspiracy to use unauthorized access devices (the stolen debit cards) and unauthorized access to a protected computer.

According to court documents, in late 2015 and early 2016, Malykhin used login credentials supplied to him by another hacker to illegally access the online software platform of a Massachusetts company, which other companies used to manage flexible spending accounts and dependent care accounts. Once he illegally accessed the platform, Malykhin reactivated dormant dependent care accounts associated with an Oregon company and issued debit cards from these accounts with limits of up to $5 million. Malykhin also illegally accessed the platform and issued debit cards linked to a Colorado company that later went out of business as the result of the losses suffered through the hack.

Malykhin caused the debit cards to be sent to conspirators around the world, including to people in the United States and Russia, where the cards were used to purchase big-ticket items at retail stores, such as Best Buy and Apple in the Los Angeles area. For his part, Malykhin received cash payments, luxury items, and gift cards obtained when items purchased with the fraudulent debit cards were returned.

Malykhin's conduct resulted in over $4 million in losses, with the now-defunct Colorado company suffering the bulk of those loses, which had to be shouldered by the Massachusetts company in the wake of the primary victim's insolvency. As a result of the losses caused by Malykhin, employees of the Oregon and Colorado companies lost their jobs, as well as investments in those small businesses and retirement savings.

Judge Gee today described some of the victim-impact letters submitted to the court as “heart-breaking” and noted the “lasting emotional harm” that Malykhin had caused the victims.

Last year, five local “runners” who used the fraudulent debit cards at retail locations were sentenced to federal prison.

The case against Malykhin was investigated by the Federal Bureau of Investigation.

The case against Malykhin was prosecuted by Assistant United States Attorney Anil J. Antony of the Cyber & Intellectual Property Crimes Section, with assistance provided by Assistant United States Attorney Jonathan Galatzan of the Asset Forfeiture Section

Component(s): USAO – California, Central

Contact: Thom Mrozek Spokesperson/Public Affairs Officer United States Attorney's Office Central District of California (Los Angeles) 213-894-6947

Press Release Number: 18-121     Updated July 30, 2018

Central District of California DOJ / 18-121 / July 27, 2018