A Russian man arrested in the Czech Republic earlier this month has been linked to the hacking of Dropbox Inc. and Formspring along with the initial claim that he was behind the hacking of LinkedIn Corp., according to newly released indictment papers.

Yevgeniy Nikulin, 29, of Moscow, is facing three counts of computer intrusion, two counts of causing damage to a protected computer, two counts of aggravated identity theft, one count of trafficking in unauthorized access devices and one count of conspiracy.

The indictment claims that Nikulin gained access to LinkedIn and Formspring by stealing the account credentials of employees at both companies using unspecified malware. In the case of Dropbox, the indictment only states that Nikulin conspired to access data from Dropbox without mention of the method he used to gain access.

Numerous unnamed co-conspirators are mentioned in the document in relation to the distribution of the hacked data. Nikulin is said to have used Gmail to communicate with them.

The LinkedIn hack occurred in 2012 and was believed at the time to involve the details of only 6.5 million accounts, but a database that emerged on the dark web for sale earlier this year included the details of 167 million LinkedIn accounts, including 117 million passwords.

Formspring was hacked later the same year and at the time it was claimed that only 420,000 accounts were compromised. However, 28 million users were told to reset their passwords.

The hack of Dropbox, which also occurred in 2012, involved a gross underestimation of the amount of data taken, with the company initially saying that only a small number of account details were stolen until a database of the Dropbox data was discovered for sale in August this year with the details of over 68 million usernames and hashed passwords.

Nikulin remains in a Czech prison waiting for his extradition hearing, a move opposed by the Russian Government who claims that he should be returned to them. Once extradited, Nikulin could be facing over 30 years in jail, although it is rare in hacking cases for full sentences to be imposed, particularly when the hacks were of public companies,not government computer systems.

Image credit: Czech police