The defendants, including Russian Federal Security Service agents Dmitry Dokuchaev and Igor Sushchin, were able to gain information about "millions of subscribers" at Yahoo, Google, and other webmail providers as late as late last year, the Justice Department said.
Dokuchaev and Sushchin paid co-conspirators Alexsey Belan and Karim Baratov to access email accounts, the Justice Department said.
Acting Assistant Attorney General Mary McCord said that Belan is a "notorious" criminal hacker — one of the FBI's most wanted — known for hacking U.S. e-commerce companies. Belan used the Yahoo attacks to launch spam campaigns, searched user communications for credit card and gift card numbers, and other schemes to "line his own pockets with money," McCord said.
The FSB, an intelligence and law enforcement agency and a successor to the Soviet KGB — used Belan to break into Yahoo's network instead of detaining him, McCord said.
Baratov, a Canadian, was arrested on Tuesday, the DOJ said. The three others may be in Russia, which doesn't have an extradition treaty with the United States.
Belan was arrested in a European country on a request from the U.S. in June 2013, but he was able to escape to Russia before he could be extradited, the Justice Department said.
Yahoo disclosed two separate data breaches last year, among the biggest in history. A 2013 attack revealed in December affected more than 1 billion user accounts. In a separate 2014 attack, disclosed in September, information was stolen from at least 500 million user accounts.
The Justice Department said the indictments by a federal grand jury in Northern California concerned at least 500 million Yahoo accounts for which account information was stolen, and at least 30 million Yahoo accounts for which account contents. Eighteen accounts with other providers, such as Google, were affected.
Targets included Russian journalists, U.S. and Russian government officials and private-sector employees of financial, transportation and other companies, according to the Justice Department.
"We are deeply grateful to the FBI for investigating these crimes and the DOJ for bringing charges against those responsible," Yahoo said in a statement.