Viktor Pleshchuk, who was one of eight suspects from Eastern Europe named in a US federal grand jury indictment last year, was arrested in his home country of Russia in March.
US authorities believe Pleshchuk and Estonian Sergei Tsurikov were the ringleaders behind the attack, which compromised the encryption used by the processor to protect customer data on payroll debit cards.
This allowed the gang to raise the limits on accounts before handing over 44 counterfeit payroll debit cards to a network of "cashers" who withdrew over $9 million in less than 12 hours from more than 2100 ATMs in at least 280 cities worldwide, including in the US, Russia, Ukraine, Estonia, Italy, Hong Kong, Japan and Canada.
Pleshchuk pleaded guilty and agreed to provide prosecutors with information on his accomplices in exchange for a six year suspended sentence and four years of probation. He was also ordered to pay RBS WorldPay 275 million roubles ($8.9 million), according to Bloomberg.
Last month Tsurikov was extradited from Estonia to the US to face charges which, if found guilty could see him jailed for up to 35 years and fined a maximum of $3.5 million.