The Department of Defense's payroll service and customer accounts at 14 different financial institutions where the objects of an attack by three men who were trying to steal $15m.

Two men from Kiev in Ukraine, Oleksiy Sharapka and Leonid Yanovitsky, and a third man from New York, Richard Gundersen were charged by the US Attorney's office in New Jersey. The charges include: conspiracy to commit wire fraud, conspiracy to commit access device fraud and identity theft and aggravated identity theft.

The New Yorker, Gundersen, who was allegedly facilitating the movement of the proceeds from the hacks, is in custody. The other two, both Ukrainians, are still at large.

Over a dozen financial institutions and businesses, including Citibank, JP Morgan Chase, PayPal, Nordstrom Bank and Veracity Payment Solutions, were hacked and once they were in, the thieves started moving money to their own bank accounts or on to pre-paid debit cards.

The men are facing a maximum prison sentence of 27 years for the charges against them. The would also be facing a fine of $250,000 or twice the gross amount of the gains they made plus a fine of $500,000 for laundering the money.